Extracted

• • Target
    0b038d9ab74d192d84259dd30cd25d6a9db324cef08d6df6719e19c14ad5a598
  • Size 45KB
  • SHA256 0b038d9ab74d192d84259dd30cd25d6a9db324cef08d6df6719e19c14ad5a598
  • MD5 4c59a71cff1881ec00a4edbc2db13fa5
  • SHA1 6ddb0c7e60661f65462eca901cfb4e871f09b4af
  • SHA512 fb480b208cc418d0ecfc79f75e6208ff525a7631d3b4b44bd618061c844c4c19fb951f78dd00ab45e4c235d619fcfe1a43c3300608445a20d9aebf2cae2b1907
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFG9xY6aZOOPIrzjbSg93i72OZuTT+3BDZEx:MuLAZTnbg2Ds/O3r3bV9S7fZoTgdEx
  • TLSH
    T14A231A003BE8822BF2BE4FB4A9F26145467EF6736603D64E1CC4519B5713FC686426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2