Extracted

• • Target
    f0badc88056578e94b444d88ed3b85a05f720786f359d3daf480057574b3b638
  • Size 45KB
  • SHA256 f0badc88056578e94b444d88ed3b85a05f720786f359d3daf480057574b3b638
  • MD5 1a705b1792d869a4647d2fc565b350ef
  • SHA1 32d9f3b5fe0f03ff06d82a33fd35147e755cd7fb
  • SHA512 80793cdac1dc7e8452e1af890db468965fc40e4b38d5563575f31ab9b1dc3651ab6fa581e6fb8273bd94c0978299102b8ea400ed1aa2a401e64eefe0cc25f25a
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qACLiE0yFjrdjYkk8PIuyjb5gX3ij5DSMgHR1kBDZW:cuqNJTLr62yLBXQBuebWXSdDSDH+dUx
  • TLSH
    T1B7231B003BE9C12BF5BE4F74A9F26245867AF6732603D5491C8441DB5B23FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2