Extracted

• • Target
    b15bbda40bcd90edeee2a9a7a1b6db157aa72bae5a25bbb7512343f2acbd456c
  • Size 45KB
  • SHA256 b15bbda40bcd90edeee2a9a7a1b6db157aa72bae5a25bbb7512343f2acbd456c
  • MD5 a0aa262e58006760a97e5ed72a7f86b7
  • SHA1 ec5ab498178b8fb3fb2bddf242d7cedde3d9e732
  • SHA512 826fd99cd66bb589734b7e741997bdf07fdb931617471171b93e1d16911ae0844917111dc1ef97386d9ebc8d785bf83038d0e91d6d83a036f1bc0e55898261da
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q16T2QAm7PI1qjbPgX3iC9pZVCwoj5taBDZcx:RuxkJTgip2mT1mb4XSC7Y5adcx
  • TLSH
    T11D231A003BE9823BF27E4F78ADF26145867AF2637603D54A2CC451D75B23FC686426E9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2