Extracted

• • Target
    bb123f56d03ceb80c87888ec71afe18f93e9516ed0e2076dd2e3fef5119e3864
  • Size 45KB
  • SHA256 bb123f56d03ceb80c87888ec71afe18f93e9516ed0e2076dd2e3fef5119e3864
  • MD5 9713d12a20d2a2c301793753b54a1f93
  • SHA1 35f79551b42e0913120bc096cfeb411e48a61768
  • SHA512 a7076b8a2864ff7a16f74ee42f9ac449418475a1208abbc632d98c671dda0af57f981e333a364e33d3921d3843e3eba1a01af6ed81b9e4dad6bbed60b1c8cc85
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9Ewz/y3qiPILzjbagX3i39/0yMFYmOROXOmHBDZsx:EufspTf2g2v0hL3bNXSRtMHOIemhdsx
  • TLSH
    T16E232B003BE9C12BF2BE4F7899F26145867AF6632A03D5491CC411DB5713FC58A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2