Extracted

• • Target
    bb409f03f259d01e57d149793480f1d00fad619ab2158c635673e7793bf94d9d
  • Size 45KB
  • SHA256 bb409f03f259d01e57d149793480f1d00fad619ab2158c635673e7793bf94d9d
  • MD5 e947469ae600b6b5c250e71f0878c2ce
  • SHA1 20535ac77d9c71cb539ce50bc52ad18586deae61
  • SHA512 5563f74472b703b81a3c1a6544691599410de776a17254a10bff493c85e13b6c11f7985c61f18464ff72d4d7629a0d60c8167b2fe1dac40420f6e4643d6714fe
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q92CHyTtUPIwzjbOgX3i6Zh2Wra01sUdBDZ8x:0u1YJTHcw2Bnjw3bxXS6ZhBrsUzd8x
  • TLSH
    T162231B003BD8822BF2BE5F78ADF26145867AF5673603D58D2C84419B5713FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2