Extracted

• • Target
    bb5f6a59372ee52ceb6848e5cac3f98dc0e822d98c952324ecb02353e134dd57
  • Size 45KB
  • SHA256 bb5f6a59372ee52ceb6848e5cac3f98dc0e822d98c952324ecb02353e134dd57
  • MD5 3316ca42c78b88c846df35c04209dbc5
  • SHA1 0486adc1dfbaed0766e7587a3584ba9a0a30bda1
  • SHA512 667a3f4b386da01930cac70e5de3d8dd3f8a86034ac4087a00a848da33b2bb623df7473e776e4c91fc4a6706e123ab3eea09b1d8a78d8ef7e09c1d68af813737
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9vZbyDMgPItajbFgX3ibtKqk1bOBDZsx:EulCJTHl42QmEt2bCXSbg1ZAdsx
  • TLSH
    T110232A0037E9812BF2BE4F78ADF26145867AB6673603D54E1CC4419B5723FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2