Extracted

• • Target
    b1b7c284c73f3685b5f87fd3131dc6e9c86768add987cc448ea9276c85e5dd23
  • Size 45KB
  • SHA256 b1b7c284c73f3685b5f87fd3131dc6e9c86768add987cc448ea9276c85e5dd23
  • MD5 0f957338cd6e0b8edc1bab9990d6b86b
  • SHA1 fa224d97066ea98e079eb7d514b9944faecb9161
  • SHA512 05daaab8dde2000001663b657ae962cc4256ad5c8e98bfca20d76170fc90cae69b3801b89ea772b8009617f0e43830661590d8a0e69b50d97f8ac1ea03da9087
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFQeeXKSocbbbQtN8/nPI6kzjbngX3iH519s1tL944xr:MuLAZTnbg2YeH2tNKA6k3bgXSHn9sfLJ
  • TLSH
    T191232B003BE9C12BF2BE4F7898F26145867AF6633603E54E1CC4519B5713FC69A42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2