Extracted

• • Target
    bd1127ab8ce33af42ca09de7181456ade46c7f7ab794e434728a4595754da629
  • Size 45KB
  • SHA256 bd1127ab8ce33af42ca09de7181456ade46c7f7ab794e434728a4595754da629
  • MD5 d39bf3fba1acc69714b71bb71e6bc39f
  • SHA1 215a7fd85b1ade826cc0fac39859b944a9c7113d
  • SHA512 9b68fde3457eece574d2697f78d7ed177033a3c9518cbda70e41fa67343e5bf867044ef08defc65dbc5ea0793ba17018c8b140fe10ab16c42b40f396ce72eae6
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qY2Rz3wnOPIBzjbegX3idzM5lnDOxyYK0BDZ0x:8uuSpTgyf2iz+3B3bhXSylnykLCd0x
  • TLSH
    T1EC232B003BE8812BF2BE5F78ADF25145867AF6673603E58E1CC441DB5613BC19A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2