Extracted

• • Target
    b00e03bb9894a952c74d93dad02ad6a6d9d6568779d64c80811e8bd94e268301
  • Size 45KB
  • SHA256 b00e03bb9894a952c74d93dad02ad6a6d9d6568779d64c80811e8bd94e268301
  • MD5 26b910f68b7a76de53e8cc842ef44e3d
  • SHA1 5151c43dcce6bbed1895a28c1a0503524203223f
  • SHA512 996b2bc1abfc3894fe06cbdcec9f1b5f1653d3896e46f2dacbff5acdd4fd39cc293ca94fe0a4d672d12133f7df3d73c24a488be73c89b7697d369b6284bdd62c
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q97S7synzuOPIzzjbFgXGiN06sv/Df9MigBDZsx:EufspTf2g22SYh3z3bCXv2XvLfaVdsx
  • TLSH
    T139232B003BE8C12BF2BF5F78A9F26145467AE2637603D64A1CC4529B5713FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2