Extracted

• • Target
    b7577cedfb8cc0699dd27ecb24698e0b75a2211c8d6cf320aaad48ee85c5ddf0
  • Size 45KB
  • SHA256 b7577cedfb8cc0699dd27ecb24698e0b75a2211c8d6cf320aaad48ee85c5ddf0
  • MD5 79ba0849c6e90cdebc0f5c353b507295
  • SHA1 0a9f7a7989c1ce43d186b2fa5068928ba4c93495
  • SHA512 a43fb284bbb27cc11e3f6ba5b1fb154bb0422cb4e702f843359f464aa70175031cbc1edd51142ed0f3074af710c31f16f66c980cbb2cbb5c827625ae44ce7650
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9HQ6vincPI9AjbTgX3i7pjPrb4lTlsw2uQyBDZ8x:0uPrpT/qY2BKU9obMXSRjKd8x
  • TLSH
    T1FA232C003BE8C12BF2BF4B78ADF26145467AF5673A03D58D1CC4119B5623FC68A526FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2