Extracted

• • Target
    34aa7aa70943df118de52d9c375dc5bbba815e2a9f10003e35b92522b9ec51b6
  • Size 45KB
  • SHA256 34aa7aa70943df118de52d9c375dc5bbba815e2a9f10003e35b92522b9ec51b6
  • MD5 882a4638bde012973e39a56c91fb52ec
  • SHA1 30b95c20f178550dc40037315218a2c63c330e3b
  • SHA512 23873ab4e4a62336e1b66b1a25a397e6067e802a03f94c5ca6f3580fe479dd0a2b2bd19276d67919014dceb35df7864285cccd4ce1400638827e5e68a1cbb011
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtxW8PIXOPImzjbIgN3iPeCX7rHK3p0P8Q2BDZ0x:5udApTNmU2tIu3m3bfNSGK7rHKcBYd0x
  • TLSH
    T1C1232D0037E8812BF2BE4F7899F25145467EF6673603D58E1CC4519B4613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2