Extracted

• • Target
    bf1fdf2d917bf2b2d91727b2ba88cc0e98351507c9e672b50b1e777a692499f1
  • Size 45KB
  • SHA256 bf1fdf2d917bf2b2d91727b2ba88cc0e98351507c9e672b50b1e777a692499f1
  • MD5 89826700d8a5848d47433f284c307915
  • SHA1 001c61236e3f6d3a39141c29d17b2b4cb9b5e1bb
  • SHA512 5837262315fe8a3b00870ab5b2b24a44fce80452b7d25d78a90e1edf8cbdeb16e0530a79260fdb072ff10aa59168e87f6e1d80ecf69510735aee8fac3258daae
  • SSDEEP 768:QulCJTHESwgWUK3aGmo2q9BGFZQjB4PIFfzjbTgX3iYpELdVVj3pkBdICvBDZgx:QulCJTHl42FqF9Ff3bMXSogPVj5kB+aI
  • TLSH
    T196231B0037E8C12BF2BE4FB899F26145867AF6733603E54A1CC451DB5623FC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2