Extracted

• • Target
    0b47b1948b27d4054e1b3d1e240b47f43e13b5e0a18861e0ef89cd2ae51f25a2
  • Size 45KB
  • SHA256 0b47b1948b27d4054e1b3d1e240b47f43e13b5e0a18861e0ef89cd2ae51f25a2
  • MD5 026b86ff9f2d39fc0d116cf6648f7118
  • SHA1 65dc1b9c9fb1d619039af29c7633f4548fc7d2f3
  • SHA512 0fb448772540c758f897facf8ff2e849800809a5cc30cb53974e1a325bde88f1ed81ac98afeef51cf19b3742fad527a8f6a94e720f259946d50c32dbbeeb91fb
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q112q0CCMPd4CvS8PImVjbigX3ibVQAp9BhCBDZMx:wuZ8pT1tc2MRCEWBm9bFXSbSW9MdMx
  • TLSH
    T1C6232B003BE9812BF2BE4F78A9F26145867AF2632503D54A1CC451DB5A23FC69A436FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2