Extracted

• • Target
    b3f4d61c8ce148e5ab51c44367ac2692e1d516889bf6bcc6b88635992a25c99f
  • Size 45KB
  • SHA256 b3f4d61c8ce148e5ab51c44367ac2692e1d516889bf6bcc6b88635992a25c99f
  • MD5 9da5f1a3ed6c1b58fb609ca80b7b2dcd
  • SHA1 453c661dff2072f98078881d4a805dab63de592c
  • SHA512 3c80e7e8843150856d70377e14c29647173e05be5e97caea6cbefabc23c6cb6dae7bd1e54fbc0c24ab86ba08c7ea8f67595c4640c86bb3158b2783f9c0c5b42d
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9JW8PIXOPImzjbTg03i+8gaYasq/g9RBDZ8x:0u1YJTHcw2lIu3m3bM0S+8gal1/Uvd8x
  • TLSH
    T16E232A0037E8822BF2BE4F78ACF26145467AF5677602D58E1CC451DB5613FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2