Extracted

• • Target
    b7cc3acb7f36c759e431ce59d0f709e4d1bedbb17c39708be7d5a61f3045817c
  • Size 45KB
  • SHA256 b7cc3acb7f36c759e431ce59d0f709e4d1bedbb17c39708be7d5a61f3045817c
  • MD5 537a8dfe3a5b5b58b395a4918a45f904
  • SHA1 04178a6350e9d3a039141c3051648fcf8c9d9385
  • SHA512 a96afe33d9483f01586073b9bfcfc49be86d9d4274cf3360aca3c287e10f84db8a6c682a6ed171628eadddef5b12689d0f9e22e28b7d20a12158b44c2ceffa5f
  • SSDEEP 768:Au1YJTHwAUgQWUaT2Wmo2q90GFZQjB4PIFfzjb1gX3i5YAB2E1BDZQx:Au1YJTHcw2MqF9Ff3bSXSCbEbdQx
  • TLSH
    T10B231A003BE9812BF2BE4F7899F26145867AF6633603E54A1CC451D75723FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2