Extracted

• • Target
    b0ffd371bc753e58a5ab91ce4f19ab2af2ec5d7c2287c58d40aa1522e8f6aefa
  • Size 45KB
  • SHA256 b0ffd371bc753e58a5ab91ce4f19ab2af2ec5d7c2287c58d40aa1522e8f6aefa
  • MD5 b5aa89bbd80879f2c5710dc9bfa14b97
  • SHA1 7de141f3cdb5c35c2f52a5ff9b5df7509bd9779d
  • SHA512 645cdd9206952e934f5b165356e0181cdb27383ac3973f650d3fbc4bdc267845ef8c4b8fa71a7fc2b74468dfe49afeb984f4324f7959044d21b5bc48f9f6aa4a
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q11BzwQ/x7PIPxjbAgX3iml7GjxqJuE2NJlBDZcx:RuxkJTgip2AaFPhbnXSmlijxaqdcx
  • TLSH
    T15C231B003BEC823BF2BE4B7898F26145467AF5637603D5492CC452DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2