Extracted

• • Target
    b1fed16ddaa79dd7f5ca70236157a13a1d59d3d5dc2492c11be61be43313745b
  • Size 45KB
  • SHA256 b1fed16ddaa79dd7f5ca70236157a13a1d59d3d5dc2492c11be61be43313745b
  • MD5 977392edfb9ae5b6e483a55f988e7ff8
  • SHA1 5b147a3a1b47028489942c3da8f86a4bf0d60211
  • SHA512 30174c973e7e07df958c5166c37e8a6ea1fde3fe2ae9c0f01db8f94f77c2589cc16f3adc2f06d29bc482a3c2539d40dd49e93cdf1a9eeafc09b567b9e070ec14
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVOT9Qpm9PI3zjb5gX3ibIRkyQDt6zet0BBDZkx:suJdpTPdI2ZQ33bWXSswDtIetEdkx
  • TLSH
    T1FA232B003BE8823BF2BE4FB4A8F26145857AE5637603D54A6CC451D75623FC6CA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2