Extracted

• • Target
    7b37f9e5cbaf356ddc8c8934006cf49228073a1c07b5e693f095f23a4e24d29b
  • Size 45KB
  • SHA256 7b37f9e5cbaf356ddc8c8934006cf49228073a1c07b5e693f095f23a4e24d29b
  • MD5 dd721774d090847143715a5a00ecad34
  • SHA1 2f6da6c949fea4bb3c2baabf9f66fff61b668c59
  • SHA512 e4948850c95e7cebd4a89fd25609fcfd5d231ee19f2210adde8d4f5118854b445d6c76a59188512222bec4acf3bcb9c41e031faf41b1d728213b89d3805b9609
  • SSDEEP 768:Iu6RaepTPYzbs8WU+Xaamo2q1m0UwPOlehAPITpzjb8gX3iqdXGsmhDz6BDZox:Iu6YepTPso2/0/OghlTp3bTXSuXNmhDf
  • TLSH
    T1E3232B003BE8813BF2BE4F78A8F26145467AF2737603D6491CC4519B5623FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2