Extracted

• • Target
    7b8949504474f1bb4267f610754ec7d92bc6a6896587334b6fd974566a8aed82
  • Size 45KB
  • SHA256 7b8949504474f1bb4267f610754ec7d92bc6a6896587334b6fd974566a8aed82
  • MD5 9a15772ff357888f850e7ba16ed0e18f
  • SHA1 9cbdf1f9cfe9f5f116e2d4560389f79c1227cce1
  • SHA512 0614dc5c0ee8461879dbbdf26fbbd69a6e886bdb63fc083897c3421b7d6588417f271291a8f76cb4dd03ef4259f71880e777e0fda5fed675676633064e036234
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1suwZQaKkPIszjbqgX3ia3OqOxPuu6qBDZUx:cu6YepTPso2/Is3b9XSa+zzvdUx
  • TLSH
    T13B232B103BE8823BF2BE4FB859F26145467AF6336603D6492CC4519B1623FC5DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2