Extracted

• • Target
    0bfa76d3c957f4f201e4b019d9658eaa911d036ebab10ee094d8488931321c9c
  • Size 45KB
  • SHA256 0bfa76d3c957f4f201e4b019d9658eaa911d036ebab10ee094d8488931321c9c
  • MD5 82c2c5383d489aa0d0361fcde41c1ac9
  • SHA1 ad74c491892179794e41b9e8d66e49fa668a7f4d
  • SHA512 9d8b693f90303a381331d2f189d9b10a995ad527557e6d05ac18ff8cfbad475de9a958a839d79b97afb7b7e3e013ccab82f8b967d2592611aa2be50b0ce79b3e
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1n+GtCVnJtHuPI+zjbYgX3iwwKqVwQ4B5BDZUx:cu6YepTPso2M+TB3+3bPXSwvuN4BndUx
  • TLSH
    T188232A003BE8812BF2BE4FB898F26145867EF6632603D64D1CC451DB5623FC69A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2