Extracted

• • Target
    bd159f3c96ccda4c044cd56245a543447a19d161221268b82dfd5c4dad8959b6
  • Size 45KB
  • SHA256 bd159f3c96ccda4c044cd56245a543447a19d161221268b82dfd5c4dad8959b6
  • MD5 3b32962975adb98757580a5d947a7c0e
  • SHA1 b0a171e538ac84c499b230035bf6a8c731d5859e
  • SHA512 bf877fa991db37312d016b3847dabed1a51d62ec1a8e0d64c8061507a871a6ceead49456b4ffdd53d0cd67a9edb1134da4533d729ef8bd5601ade8c299764ac7
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYb6EUL0Yj/OPIC+zjb2gX3iTkiArz142Of4bGkeQBD:8uuSpTgyf2TWbT3C+3bpXSwiArz2BkeR
  • TLSH
    T144230A0037E8812BF2BE4FB8A8F26145467AF6733603E5491CC452DB5613FC5DA42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2