Extracted

• • Target
    bf9a5e80f186e505b943e372f6d7544ccfd8fc0f4957e2cd3ce52948510a4fa3
  • Size 45KB
  • SHA256 bf9a5e80f186e505b943e372f6d7544ccfd8fc0f4957e2cd3ce52948510a4fa3
  • MD5 ae214748c72632a76de482c3a430ce5c
  • SHA1 c246c92eca19906886bb3cade5669879d2c7b932
  • SHA512 652d36c00a94fd3c5b9573b1b344f20157b566194f7f29656c80eddc4216429ccb43712bc1e1b3e07eb81d567e6cde5c41843ebf1b31bbf4ef6a5c6da2ed11d0
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q16T2Qpm7PIKGjb5gX3iSr7Lj0wPRP1R9BDZcx:RuxkJTgip2meKqbWXScLjRPdTdcx
  • TLSH
    T177232B003BE88237F2BE4FB898F25145867AF6636603D64D2CC451DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2