Extracted

• • Target
    b1f4a31000e4005ef3882405b018bb54769058ec1e61b50bf90f3c804f995169
  • Size 45KB
  • SHA256 b1f4a31000e4005ef3882405b018bb54769058ec1e61b50bf90f3c804f995169
  • MD5 a695863ef2c657c899fefe477eb2beb0
  • SHA1 a2d97f4144490881fb5c256592b25d180b46c248
  • SHA512 75372d53769e311a314d87483fd9d56b2a52ba941979ded4ef38e8b74ea4f98cc85660509fdd01c58f43854e230fd21e858c6410bc0117c34a5bf96fc0b2be76
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlzfBohEa+PIvojbpgX3iGEgvYJtFPku9HGBDZMx:wuDWZTpMZSB2S4EaHvAbmXSXcYTtVIdO
  • TLSH
    T1B2231B003BE8C22BF2BE4F785DF26246857AF1736603D54A1CC451DB5713BC69A42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2