Extracted

• • Target
    b94831f983b02fd8c312cfc3eebce18b1116d795552349f2da735de4665a82c3
  • Size 45KB
  • SHA256 b94831f983b02fd8c312cfc3eebce18b1116d795552349f2da735de4665a82c3
  • MD5 485d7203d6013f4f6841189c46cd2b43
  • SHA1 2a5535e35f92b4b7055e58ebb810678d8d8565d5
  • SHA512 79e2cd7677977688d7c439165832a64be6407f772ce508ff731da89cd420b680064430bbfba83128ee1c0a3295732a7d25028501f8d97939fca26a0719870e30
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFleeXKNopRr8/nPI6nzjbjgX3iwffS3elCTKd33BDg:cu7e5TH2A2leQgRrKA6n3b8XSw3EI+c2
  • TLSH
    T160232B003BE8822BF2BF4B7899F261458A7AF2737603D54A1CC4519B5713FC58A52AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2