Extracted

• • Target
    b18cab6e119a7dc0dd2fe56472ec72b6a22e422d04cc0b3c7fa37abec1ff1dc6
  • Size 45KB
  • SHA256 b18cab6e119a7dc0dd2fe56472ec72b6a22e422d04cc0b3c7fa37abec1ff1dc6
  • MD5 bf8d423e8ef48aee463aa6b5d5d9a184
  • SHA1 863782f133f8635e1c97e60c4faf354c3a60b78d
  • SHA512 7d72bb3903b7a0fb8abf992672a54a5130ca10fbede4c25d0ac206177ccdc9589a5a0418bb3d60bbc1e3f82b038860019c6c6d8828e6e47ba181baab3a3813af
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9LK1YJBOPIxq7zjbggH3ivCKXK2SyHSyyyNBDZsx:EulCJTHl42riz3xS3bHHSvCK6FGyyDdu
  • TLSH
    T1FD23190037E8812BF2BE5F78A9F26145867EF6673603D58E1CC451DB4613FC68A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2