Extracted

• • Target
    79a7b7c63c5842ba92ebd9c0eadff3dbf12b1a0aae89a41e2fda443fd8bbfba8
  • Size 45KB
  • SHA256 79a7b7c63c5842ba92ebd9c0eadff3dbf12b1a0aae89a41e2fda443fd8bbfba8
  • MD5 5ea56e9d48214afaec87c9589bd8efd7
  • SHA1 dc08ae9cd674cc77c8fff2e7b7d117be8f7819cf
  • SHA512 7272e86d5fc25013e6e4da6b9e8112333457ef8fd7bec6e079f31d81b9bb7996f76edaef6f1b9c9cb2bf516f2393f9a76daa68ffe7aba8a00f2d21b2394c68a6
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9srE7HLCjJOPIImzjbGgX3WKgba9l88qt4RlL4BDZ+:0u1YJTHcw2rSWN3Im3bZXmD2Yt6L+d8x
  • TLSH
    T10B231A003BE8823BF27E4F789DF26145867AF6632A03D54A1CC451975613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2