Extracted

• • Target
    bd428085480553e11123cd819200441428840010e3e2b35aca410b843930d5c5
  • Size 45KB
  • SHA256 bd428085480553e11123cd819200441428840010e3e2b35aca410b843930d5c5
  • MD5 d2d65b072f2cba38e70a960588532d0e
  • SHA1 94c09090a4f39ccfe138ca52b2be722f68a3a9f1
  • SHA512 9ddc04d8ea5afb45055bb067f70503368287dc4648dc53a56ecfe1d2fcacccf157b88c71b3217ffa53e9fdcbe0913eb8f698aa5d88909e11346f5469425eb209
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVh0e3NEARViZPIrzjbkgT3ihvUkPPPXsq7KZgJkgBm:MuBGJTPho2E3e+iWr3brTSHHfsqnn/dG
  • TLSH
    T158232A003BE9812BF2BE4B7499F26145867AF6636603D54D1CC451CB5723FC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2