Extracted

• • Target
    00bc559e55e20ee2817ea7d10947811b97cf771ec275452bbeb51b9bcb361df4
  • Size 45KB
  • SHA256 00bc559e55e20ee2817ea7d10947811b97cf771ec275452bbeb51b9bcb361df4
  • MD5 f56ced1f5c42b15c27535203de61cadb
  • SHA1 7903c7576ac70217d840596f625f7946a1b6e9db
  • SHA512 1edf89aa8ce53fc2acc4cf5a1c2b0b75e71375e7973d7dc5f61c28bf164f172ecbd01e897867706942dff9a6bb19cd30a02be05d604d7cf4fa570887832cff2e
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwP3Fo9EaOPIJzjbAgX3idKBAO6uURZk7/RuBDZMx:ku40ZTXEb258Ea3J3bnXSd/OmRZk7Zg8
  • TLSH
    T1D6232A003BE8C12BF1BE4F789CF261458A7AF6A32603D5491CC451DB5613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2