Extracted

• • Target
    bb4db8f1e4c41ec4c17bf616b32d67de74891a33b27cfc09734674e36c01b507
  • Size 45KB
  • SHA256 bb4db8f1e4c41ec4c17bf616b32d67de74891a33b27cfc09734674e36c01b507
  • MD5 f5060b2fad4a4322eba2f2fd0bdbd50d
  • SHA1 a63f4ab0ac278a50e3e145846d7cd569955dc037
  • SHA512 e52d176009d7ab818226e0015432cd68ba70bb345d0898baa670cb7632a2d702d2e6cd91c67bb145c32eb4e51da53bc470b5750a3800ea9aa9e8dd2088b1e7a2
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9Z9oyvinXPIpqjbXgX3i+c6dedsLvlxUEXBDZ8x:0uPrpT/qY2MaC1pmbwXSld64ERd8x
  • TLSH
    T1DC2329103BE8C12BF2BE4F7899F26145467AF6632A03D68D1CC411DB5713FC68A526FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2