Extracted

• • Target
    07ab03787a7015d4c51961615ab1f111b82a6a7c26058260896f52a18482b95d
  • Size 45KB
  • SHA256 07ab03787a7015d4c51961615ab1f111b82a6a7c26058260896f52a18482b95d
  • MD5 3e3ae830003e1926ae03be2ccfe7f126
  • SHA1 b80ae3e04909a657fce108c22fef1d899d0e0928
  • SHA512 38919b5a117c95dae0b47c4fc5ffa2ebf3356a0c6f978f0554ab66bafcdf825058f997be03b13df5f745c5b0270a1fc12268ac2f5c903d6b84b43335edee668e
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9zITnyHaaPIIzjbwgX3iqEqL2mPX4yBDZ8x:0uPrpT/qY2QE5I3b3XSqEGlgMd8x
  • TLSH
    T1BE232A003BE9812BF2BE4F7899F25145867AF6633A03D58D1CC411DB5623FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2