Extracted

• • Target
    79b2ab3f9696ef5e2036401fc431e6bb79a60da9a31d4c6ac91fd2c9cffa83e4
  • Size 45KB
  • SHA256 79b2ab3f9696ef5e2036401fc431e6bb79a60da9a31d4c6ac91fd2c9cffa83e4
  • MD5 7c24cbe68c3e67b41aa42351c0c2ac00
  • SHA1 9bf4b9f33b229acaa9f4a8b20eb90b16f2a7dfac
  • SHA512 bf7d9784774d2279e91abf421d53f8d5783d5ce813d4b0b0c0cc243734ce6fddcdceed89747d296ed36b5eba052bc29641d043e963f870b515a83d8d68eaf34e
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qA5pt0CCMhdjCvS8PIjajbBgX3iRALO4NGaVEbfhOC:cuqNJTLr62J/CChBj2buXSRaO4GaOmdW
  • TLSH
    T156230A0037E9812BF1BE4F7499F26145867AF6632603D54E1CC452DB5B23FC68A43AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2