Extracted

• • Target
    b1e042268d73d20f6676a918099897a7909a8fd2ac57868a311c304fb76f4790
  • Size 45KB
  • SHA256 b1e042268d73d20f6676a918099897a7909a8fd2ac57868a311c304fb76f4790
  • MD5 04b6b645371d55519365f87f3b461d0b
  • SHA1 469ad23d7e2ecac2b9455b44b3d6d997a142d521
  • SHA512 8bfc6fc670ffdf880e2ab3f3edf39b0c2c88c77c88288fd37d25dff91104a41b2251fa6cc614805d3438932dd3574c3c6ff38e27b62d137a6b705642800ae37b
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtOdR3aI6OPIuzjbLgc3iaj25eCCOEc9BDZ0x:5udApTNmU2hjqb3u3b0cSaj251FEcTd2
  • TLSH
    T13C233B003BE9822BF2BE4F7898F26145817AF2677A03D54E1CC441DB5713BC69652AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2