Extracted

• • Target
    cb67f6c65e93e5f0b2ca0eda775e7534c2f39c75a031384623065e705a16e0bf
  • Size 45KB
  • SHA256 cb67f6c65e93e5f0b2ca0eda775e7534c2f39c75a031384623065e705a16e0bf
  • MD5 c91d4d0fee11403e0476a7c5ca7b4911
  • SHA1 baf21f0305192cafb96fdca03e69b43f4d0cc00d
  • SHA512 b22f23fcf9bddd88537253a7cf4519d744f28e267f66adb3510a514c44d5cfd8f32f52c8e080632d2c1afca185c1cded8299f36f6ec59192e710f161b997d53c
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1BuwZQaKkPIfzjbhgX3iHRpoCFcXKDjcMBDZcx:RuxkJTgip2IIf3bOXSHHoGLjldcx
  • TLSH
    T11A231A003BE9823AF2BE4F78ACF26145457AF2633603D54D6CC451DB1623BC6DA42AF9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2