Extracted

• • Target
    bd0cba01f61988679451f66b33697022e058e31aaca859460d9df4a423e893cd
  • Size 45KB
  • SHA256 bd0cba01f61988679451f66b33697022e058e31aaca859460d9df4a423e893cd
  • MD5 7b2e8a7d274cc2daf75f5b8e9a945245
  • SHA1 893068fba16d1f7ee0694db1de7de6028f88efc0
  • SHA512 118a75a56a03a4eb36179d39f28f9226ea6fda7c7566e5258e6d0bd7dc0efbaa3b1efe7e18d48021ccb93689c31f37337c71bd574b6f72463f6857938ce2cfc8
  • SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7JoRQKIJOPIhzjbOgv3iN8BNgHkQrKd5WKUBDZ8x:0ushJTDXgH2oYxg3h3bxvSN8BCH7rGRF
  • TLSH
    T19C233B003BE8812BF2BE4F7899F26145467EF6673A03D54E1CC4419B5B13BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2