Extracted

• • Target
    b125d50fb6affe5ced8fe871751c075d381933f58d0413c285bbe6f4680496a2
  • Size 45KB
  • SHA256 b125d50fb6affe5ced8fe871751c075d381933f58d0413c285bbe6f4680496a2
  • MD5 d76ef7a2681c97c85393f33c9d7c50a5
  • SHA1 d3321051577c7766a2fe2f386a309ecdc92a877d
  • SHA512 7c38de63353851d056baf5b5b3232f4f8d59b17c7662381ab312c12e839fb0cf8fcf3aa4696970804e9da2ff78923e89c187f66e045adce8404ad00a1b1ed5ed
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVJpt0CCM+d4CvS8PIkrjbugX3iqvnDFbS15WC9BDZG:MuBGJTPho2Q/CFWBk/bRXSMDBS1bdEx
  • TLSH
    T1892319003BE9812BF2BE4F7858F26245867AF6732603D6491CC451DB5B23FC6C642AF9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2