Extracted

• • Target
    00bd59eb71f7b651f0e33e85c0620e6d64f67eeaf66b7a06ce828b8c2fdfa747
  • Size 45KB
  • SHA256 00bd59eb71f7b651f0e33e85c0620e6d64f67eeaf66b7a06ce828b8c2fdfa747
  • MD5 3616f50a2be0659692b281dadad0be22
  • SHA1 bf18eb5e6fa546785fcbe752f8e78646ca8fedfc
  • SHA512 e58365e10b3edd119a12bd96166b69355a1704ce1c330e157bc47234a37841158f0f99f18b4346f361cff6a680d67a87bed3d92bc8f59870659200062be96f68
  • SSDEEP 768:5udApTNctooWUS7C+mo2qttiaLMwJAOPIcAzjbOgX9iYwTBkI9B0WBDZ0x:5udApTNmU265n23cA3bxXMlTnDVd0x
  • TLSH
    T1F0231A0037E8822BF2BE5FB8A8F26145467AF6633603D58E1CC451DB5613BC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2