Extracted

• • Target
    0f1b42c53d73b58ce4021ded54b7e4938b37253c44446f793690793832e458b8
  • Size 45KB
  • SHA256 0f1b42c53d73b58ce4021ded54b7e4938b37253c44446f793690793832e458b8
  • MD5 65dc2fe61598aff9868decebb937fed9
  • SHA1 bf0990a146e00fba9be75bbddf1cfe27fcde415f
  • SHA512 1e956fa28137c0a52400d7e4519f760de246a656ed5cf65e8599a130eb832f0db3bd8fc46a06b7be526d610dbad4e826cff5e3f4f1a4724cf4690a3e6284e793
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q13maPAlQ3APIKzjbrgX3iUM/DxGzef4BlHqFi4VeGt:RuxkJTgip2WfAO3lK3bUXSL7dkKFi4us
  • TLSH
    T1E5231A003BE9813BF2BE4F7899F26145867AF2637603D64A1CC452DB5613FC6CA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2