Extracted

• • Target
    be2b5ad2a5933711e6529293739bea3312b90b354899aba35e94db1a75709949
  • Size 45KB
  • SHA256 be2b5ad2a5933711e6529293739bea3312b90b354899aba35e94db1a75709949
  • MD5 c7c7d6e047580435b9781b822f9d6687
  • SHA1 b8aba712b8050342f3ae3625208f866e71cbf63d
  • SHA512 752c475e246c002d19f696adaab4b4fa961f3132409034d4efafa0f2fcbb2b5f47f29959b0f24fac8f8f679fb77bad0ed13cc2d31aedc909c7f541b8acbf4137
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFvZTohEaSPIXzjb0gX3imTphlwQBG/LTagBDZEx:MuLAZTnbg2O4Ea7X3bbXSmzlfBG/LTax
  • TLSH
    T13D232A003BE8822BF2BE4F789DF26145867AF5632603D5592CC441DB5B13FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2