Extracted

• • Target
    04bff2379482cd22baf2d9e287fa8d22098506e60ad84a3f223fac3fc268fa6c
  • Size 45KB
  • SHA256 04bff2379482cd22baf2d9e287fa8d22098506e60ad84a3f223fac3fc268fa6c
  • MD5 c3c17aecd456e19518c199bcb21e2a66
  • SHA1 c6b6e326b647470ab17aa586bf9934f966595060
  • SHA512 fbad12f50c8c3243d9e23333063b390eaf28231548491f10a64f9c4b709e77dab6d2f2d629ec72c91caf2762075e0cb56a9e9eaf9463ef7561ebff123e8f431d
  • SSDEEP 768:Iu6RaepTPYzbs8WU+Xaamo2q1LviQD7ZwqKEdNPI4zjbSgX3izbZRMnnZoWyyJFO:Iu6YepTPso2IOqKEdq43bVXSZRMnZoWU
  • TLSH
    T1BF231A003BD8C12BF1BE4F7858F26245867AB6637603D65D2CC441DB1713FC69A52AF9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2