Extracted

• • Target
    080b671dc77f28a8746e0ab36b18d885d258e309096bed68265daa0dbf6ee76d
  • Size 45KB
  • SHA256 080b671dc77f28a8746e0ab36b18d885d258e309096bed68265daa0dbf6ee76d
  • MD5 89e9da3ab0a31b450032cb2cf9596ab7
  • SHA1 08d6c68d0ef50394d0536b50a2fecb6b026f6978
  • SHA512 7a0966c4dd290b27d123162d48ba97a05b8fd0019ffe7fb960b550cd4ae9f9e5ff761a7812c58ef05559a8a58f46fa873de3b30ab555445c23ef7a1e647ada78
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVCHUttXAPIV9zjbcgX3eQjoL2iaqd4BDZkx:suJdpTPdI2f0rXlV93bzXuu+wdkx
  • TLSH
    T1EF232B003BE8C16BF2BE4F78A8F22145867AF6677603D54E1CC451DB5623FC68A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2