Extracted

• • Target
    a2bf7016510e2dd25c1e8acf6bdfd11479204b5be3542b3363aa8b1768f47f4b
  • Size 45KB
  • SHA256 a2bf7016510e2dd25c1e8acf6bdfd11479204b5be3542b3363aa8b1768f47f4b
  • MD5 b394de993dd13ee991e4be866c069d94
  • SHA1 f0959c372fd93188e9ca9c12091c7108aa03a762
  • SHA512 c4410b146f628c4a55ce39231567bed7f8f2fb9d1d1f705ca23bf6788f61f9068c1dfdf503f1e928f40d584c3b0e1b057033cc2426fb83a53ad777b35f0f86b5
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4b9wa0y/zFOPIuzjbLgm3izLBfKUGSDCa+CNH1BD:8uUIpT4vAj2fCdi3u3b0mSf5pOC1bd0x
  • TLSH
    T1B9232A0037E9812BF2BE5F7869F26145867EB2633603DA4D1CC451DB1723BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2