Extracted

• • Target
    b075adbb9602ef5b21406d6a57028b34913c0d6ebd67006cb18e8c40df1ca3ef
  • Size 45KB
  • SHA256 b075adbb9602ef5b21406d6a57028b34913c0d6ebd67006cb18e8c40df1ca3ef
  • MD5 3432e04fed936571e5a0398f0503a96d
  • SHA1 d4803c9188289b13b3cad12859a6c7a876b204b4
  • SHA512 1ccb5503bd62eaefba9f13cadf4951d40d62dd81988bade3ad3f72bd55f05777cacce15fe7151d3f49ac7bc32e1c8e39115ea7eb4d4db0b2d891071d5451a353
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAvT9Qpm9PIzzjbdgX3ib0JlBgm2oEoBDZcx:UuKWgSJTwRf2hQz3bKXSwx2oEOdcx
  • TLSH
    T183231A003BE88237F2BE4FB868F26145467AF6736603D54D6CC451DB5623BC6CA426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2