Extracted

• • Target
    1bbbd3314c486d70b200eae83c0c43e3af3148bde11cf084ab4bd9402ff1f6cf
  • Size 45KB
  • SHA256 1bbbd3314c486d70b200eae83c0c43e3af3148bde11cf084ab4bd9402ff1f6cf
  • MD5 d20eeb89e8a9d70423d30455fb3402da
  • SHA1 ab8977f44bdbd80077de35235519bd5e1fe1a348
  • SHA512 b42bfe78c9fe04d4fa9e81dd1ca529fc38fe24dc0704303265782c46928fca12cde786e70d7fde4e4f88f1cc12b4802e4a5f9e1bb5663b5156970b6f2b81bb66
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qj4ozfy3CKPI0p2jbJgX3irFs9YjFAG5pG98HBDZ8x:0u2vpTDe+22TR0p6bGXSHJi9Wd8x
  • TLSH
    T12A233B003BE8C12BF2BE5F7899F261458A7AF6633603D54D1CC4129B5713FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2