Extracted

• • Target
    bd5f86b0310b16a96ba91f4b1a11d14a99befbfbdbe826f3cec1594820cdb4ac
  • Size 45KB
  • SHA256 bd5f86b0310b16a96ba91f4b1a11d14a99befbfbdbe826f3cec1594820cdb4ac
  • MD5 d613b1ab0e0fcb1514d4c66b766dab99
  • SHA1 a6ae5493616f5bd6c4cac784486af3adf658f4ae
  • SHA512 1487397d0bc528ad8d27623a552be0179b9ac08c1aea67264793d289739791e8dd08a31c0269259ef66ee3e89343c640a5f45b25cb57935a0ee1fc6eb40ff27c
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwIeeXKSocbbbQtN8/nPI6kzjbzgX3in8pKAHpqacdu:ku40ZTXEb2VeH2tNKA6k3bsXSn8vRcz8
  • TLSH
    T19A232A003BE9C12AF27F4F7899F261458A7AF2633603D54A1CC451DB5713BC68A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2