Extracted

• • Target
    fb1abe8eb655d293cc113f96db0ebffb7b01ef1a3aa12cae470b0399f5284075
  • Size 45KB
  • SHA256 fb1abe8eb655d293cc113f96db0ebffb7b01ef1a3aa12cae470b0399f5284075
  • MD5 2abe2b133ba8abf6f0b1eaff57d45369
  • SHA1 b1f7acd2c3cb2a9a793dc7f9b857cc1e2b3d91ec
  • SHA512 f11451cd74cd8a616c82d54bd5a6a1ffce11c2eda0328a3373c00dbb167900b33b717061c1418c9982f8d6f13c0b414a2c8686bf5cb94ea86549b61f1cb9dbc3
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1BuwZQaKkPIEzjbKgX3iKX8edD+pkagKwABDZcx:RuxkJTgip2IIE3bdXS/yD+mjKfdcx
  • TLSH
    T1CA233B003BE9823BF2BE4F78ACF26145867AF5636603D5496CC411DB5623BC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2