Extracted

• • Target
    1b86c4ebf4225d3f63b9350cd2a9e91ad43aeb81f5e01e8cc40e51f31fcdfe28
  • Size 45KB
  • SHA256 1b86c4ebf4225d3f63b9350cd2a9e91ad43aeb81f5e01e8cc40e51f31fcdfe28
  • MD5 511e8bf2870a9c08c1c06f49d0030506
  • SHA1 b312d96b9bb0fa2cfcdf0da34bc6b38bbacd5d6a
  • SHA512 9e1908a56ca7e0213ba1e52029b2fd12928268aaf8d651561193e11cf71b5e2d648c548b9aaf507da355c5362a8a2893c4c6e26cf83aeeac755b4dd6f3697cbd
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q94EYSCBTPKNjPI4zjbWgX3iIW5gYcfOs2ThlhRBDZu:EufspTf2g2BEl8KK43bJXSIcgK9ThlhU
  • TLSH
    T1B8232B003BE8812BF2BE4F78ADF26145467AF6637603D5492CC451DB4623FC69642AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2