Extracted

• • Target
    b0684a887de933bab1329a932a7241b0445eaa89d888697bfdc40cfa82976f39
  • Size 45KB
  • SHA256 b0684a887de933bab1329a932a7241b0445eaa89d888697bfdc40cfa82976f39
  • MD5 b6c511ca7a2bd16b39399d545e0ee652
  • SHA1 7db0a5a39a6875515c08e26700917557d49174c9
  • SHA512 559412c64234a6834f31d44aa4f211a856d71135b5de65c7ee8c087732ebe90c030b2a138017d8ebca82580a1e2cd3233156a145852d5c6386eeb6bfee3b2cff
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFK/T3u40cMOPI0Yzjb7gXAi54ku7m2RzcIaYeBDZUx:cu7e5TH2A2ji+M30Y3bEX9uKdUx
  • TLSH
    T1FC232B003BE8812BF2BE4F7899F26145867AF6633503D54E1CC452DB5623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2