Extracted

• • Target
    df6f69ae3bf72af0ed13a4def6241414af8e5753a1813e26d96cd7950c58c3fb
  • Size 45KB
  • SHA256 df6f69ae3bf72af0ed13a4def6241414af8e5753a1813e26d96cd7950c58c3fb
  • MD5 1ca66389aaa8229ce555667eeef159fa
  • SHA1 78f3b0b736452835c38cd7778cfd8367c1881157
  • SHA512 ce995b4483bdf995e8e4be46b1f2a32fe221e6315f6da0d4921b30ed0ffca3be84176a1c5a0d2b70cd6d72608ca00bcc26c7ea108814741d54331098d48be1e3
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9x/cYssPJZOPIcvzjbzgXYispb4VSiYqyQx70DDBDZu:EulCJTHl42eMIf3cv3bsX1v7YqfxIDFc
  • TLSH
    T141232B003BE9822BF1BE4F74A8F26145867AF6677603E54E1CC451DB4613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2