Extracted

• • Target
    b1b36cff44d2e904c9deae79c98d19a7619f495fdaf7d0d28208f81db53f0f83
  • Size 45KB
  • SHA256 b1b36cff44d2e904c9deae79c98d19a7619f495fdaf7d0d28208f81db53f0f83
  • MD5 7cae64610d5f7c885f33f1cd0858921d
  • SHA1 696f16c1fa67d760dd7ad15dc152aec086817dad
  • SHA512 739540be3f246532fa67dd4812503240c1fb09989574c058ea0fd249d3ade9d7456dae0b19420d9d4843c71f4d03cbbbcdfb0217fb52eeba5b8af0bda38cd491
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNrwD/y/aqPISzjbRgX3icmNYauee/BDZ0x:5uSy6pTpoo2okhS3beXScmmeSd0x
  • TLSH
    T1A9233B003BE9C12BF2BE5F789DF26105867AF5633A03D5891CC411DB5613FC58A42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2