Extracted

• • Target
    bf6c8e32f7eee5bf6e60d00e13e55bf90dc9986ab174f6ad66535de0857c8a5b
  • Size 45KB
  • SHA256 bf6c8e32f7eee5bf6e60d00e13e55bf90dc9986ab174f6ad66535de0857c8a5b
  • MD5 9a405f62848cb99c2ecf18f7e5898f99
  • SHA1 c7d6d8f738a827f69646e542dad616629c540016
  • SHA512 889e493aa0508f1ff4212aff46f901b6f76b37cf6bffc2afbf659cfb6ea1166437d857efa9d7e1102ad896c97604384068cc5e84feb22c5b7c2c64023a66f17b
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1N8V1RpYEcPIazjbRgX3ibsknybkg2hBDZUx:cuR0JTPjY2+8VDeEha3beXSwknybkg2s
  • TLSH
    T142233B0037ED822BF2BE4F7899F26145867AF2633603E64A1CC451DB5613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2