Extracted

• • Target
    b85d5ef9105b4591141e4a642988a57afed29868ca1e6e9a96ab0b4b02f48c6d
  • Size 45KB
  • SHA256 b85d5ef9105b4591141e4a642988a57afed29868ca1e6e9a96ab0b4b02f48c6d
  • MD5 4f256c3ad8cccc2dc53464e3b8c8147c
  • SHA1 2bd46f3e1be47def4aca38b1482c41ce2f63483c
  • SHA512 b16c47d1800d9bcfa3595c250399b2063f03c22b311e0d1a05f10f632c18536acc8190952023e5fcd3ad6d126695ec37c82320a542997befa8cf8bdd0a62b2d7
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4wO5QPCBjPSNjPI/zjblgX3iPg0tlmRcDmaBDZ0x:8uUIpT4vAj20O5sMSK/3biXS46schd0x
  • TLSH
    T176233B0037E8C12BF2BE5F78A8F26145467AF6637603E54A2CC452DB4613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2