Extracted

• • Target
    b1bca49f2da624595de06c63cae8fb23a3f264c7e60338bd6036fb5f7cab7906
  • Size 45KB
  • SHA256 b1bca49f2da624595de06c63cae8fb23a3f264c7e60338bd6036fb5f7cab7906
  • MD5 2abf8a69b96505e1a919a54f43e9b7c0
  • SHA1 fff6b8b54ad67a23521a107400228bf3c10c2bda
  • SHA512 06e409677f8f3e1ba3d780bb216dd8eb9fa597f7f5f48785b053ec68f86859fd33ee73c43873d2a08ded59281715577c692923bbc4c07534da33116e2ee02f79
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1/BzCQKx7PIm5jbmgX3ihfrbx/LLuv+4FGUBDZUx:cu6YepTPso2+o0m5b5XShzbSdUx
  • TLSH
    T13C231B003BE8822BF2BE5FB8A8F26145467AF6633603D54D2CC451D75723FC69A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2