Extracted

• • Target
    bd88d61766562a05c98b6afd1872198442a5f681ce881b344784a6ffb92308f4
  • Size 45KB
  • SHA256 bd88d61766562a05c98b6afd1872198442a5f681ce881b344784a6ffb92308f4
  • MD5 2576c8ee17d955b2bf6c36135935156e
  • SHA1 d1d6ff6b946f2d45f765ede66e3e85d3cbb04e0b
  • SHA512 80b90aba15baab68a0f7a8a14aadcc0b55550b07ee343d5f6b31d33e0eb2b669c4cde4fe3996c52b4e6c9b798b6c1765e613a7406baf9b3f6e64284b70b76abc
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYZ/rLzlJAOPIc6zjbEgXHiOCOGUCj3CxKG74BDZ0x:8uuSpTgyf2hPp23c63bLXC3OG3zPGSd2
  • TLSH
    T1FE233B003BE8823BF2BE4F789DF26145867AF2673603D5891CC4519B5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2