Extracted

• • Target
    bd1b33442db53e9e5ae3f93ae771cfc8531b75fbcd811d86eb13c844257675d3
  • Size 45KB
  • SHA256 bd1b33442db53e9e5ae3f93ae771cfc8531b75fbcd811d86eb13c844257675d3
  • MD5 50a995c7c701fe43064afac26608fe16
  • SHA1 5005ae4c10319d4a968b783b518f6c057dc34743
  • SHA512 6202466881e32d71c31be76289e836118fc540981c9ae576c8646f631b17014bd72b9613ea5320d74ae1a035e8170deb38ea270eab2d73566f92591377b70288
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyL5P02FUFdiYkk8PIfzjb6gX3i3WbGcpYWOsy+BDw:MuBGJTPho2/LDmhBf3btXSor4QdEx
  • TLSH
    T115232A0037E9812BF2BE4F78A9F26145867AF6733603D6491CC451DB5B23FC58A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2