Extracted

• • Target
    b36ec11891f12b9072e34a815bad1f7326c7c78b8f81841c8e43d23238aec1c3
  • Size 45KB
  • SHA256 b36ec11891f12b9072e34a815bad1f7326c7c78b8f81841c8e43d23238aec1c3
  • MD5 bb7681e9fd170ef23ca3986660e01c50
  • SHA1 c97fc99e83ed90344b828abed5d5297353e5fa0c
  • SHA512 919bc5e30026f60193094d773d303695253b55de942dc5eec4119a50ada45faac39858d2c67b74c27c927a64335ee336a314a51cb6a1d3da1c0e0ddb7114d9f0
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1umaPclm3API7zjbtgX3iEzzih895dBDZcx:RuxkJTgip2PfcE3l73b6XS2Gh895zdcx
  • TLSH
    T182231A003BE8813BF27E4F7899F26145867AF6636603D64A1CC442DB5723BC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2