Extracted

• • Target
    b79a0b7c6724cb142c4db9e5dc7f339594730646f2644f344dd2b7c08ba7802e
  • Size 45KB
  • SHA256 b79a0b7c6724cb142c4db9e5dc7f339594730646f2644f344dd2b7c08ba7802e
  • MD5 b4c2e582a3bef08187675dd81e5efe40
  • SHA1 692556ebd46e4afd3288fb0ee430d804731e4de7
  • SHA512 29f3bb40cc054cfaf913a32dafb2a9d1c4f344e6dcfd04e629a9b1a73d802c582628dd38b8291300873dbef4b3eb7a89dbd88dab2f017434476cc38526e621ed
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9liaLMwJAOPIcAzjbugXJi623zXT6JOBqwcloBDZ8x:0u1YJTHcw2S5n23cA3bRX4pOJHFlOd8x
  • TLSH
    T1FE232B003BE9822BF2BE4F7899F26145867AF5633603D58E1CC451DB5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2