Extracted

• • Target
    b431c12f326ee2af7293fe525bd5352145bf800dcada42961555133d29b524b7
  • Size 45KB
  • SHA256 b431c12f326ee2af7293fe525bd5352145bf800dcada42961555133d29b524b7
  • MD5 b66685d47e4c9b3f8c3df2f892e6b492
  • SHA1 42e4931151cedf829e6c01621656cb6be016e4e0
  • SHA512 45b202d711e261d102100247043641ef4dc4a8f340bab6a89ca960242949e4845ae514a1840724b4cd46a94a2df2e596ceaa74c6d2ea10c33b78b84fca43212d
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFPeeXK5oibbb6TN8/nPI6WzjbVgX3ivjLM8dy2MGB0:cu7e5TH2A27eEqTNKA6W3byXSvjLMc+D
  • TLSH
    T15C231A003BE8C12BF2BE4FB8A9F26145867AF6732603D54A1CC4519B5713FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2