Extracted

• • Target
    c004bee6874db9c80ed815033a5144116d05a23a9b0e77f8ed1bc36474fde297
  • Size 45KB
  • SHA256 c004bee6874db9c80ed815033a5144116d05a23a9b0e77f8ed1bc36474fde297
  • MD5 8c399758370e4e3e81422383adcff7a2
  • SHA1 d1b3c98b24cf0a4d1562d697841f37925d3258f1
  • SHA512 75201f6ad4e6640483cf451d529686d9920a5b4368983b142ab908a5ad24b91ef49919c93d68266fd4c0a770d330fed8a0664212f7a17116909f4ba0fbb82e7f
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q97S7synzuOPIzzjbjgXsitJnexEYOixaBDZsx:EufspTf2g22SYh3z3b8XJznexridsx
  • TLSH
    T145232B0037E8C12BF2BE4F7899F26145867AF2677603D54A2CC451DB5623BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2