Extracted

• • Target
    a6dc2504224dbd13d79520262427fb41be5ecd96c59343e399be127f83b9247a
  • Size 45KB
  • SHA256 a6dc2504224dbd13d79520262427fb41be5ecd96c59343e399be127f83b9247a
  • MD5 8f0fe3e6f05d1371ea532dc7daa038dd
  • SHA1 e7db6ec9963f0c6d7c3df675a908dfc6fbb752c7
  • SHA512 ddaf18e392ecbc5ecdbb41c7b40c61cc28c05d30924f0da4e4434ccefd5434b2c02d4590f731a78959a5a36af530a28960e42b70cfad3e9fa1b143b322bd4bb2
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFWAuXueM+D58vnPIM9zjbkgX3+0E2EqyzqhBBBDZEx:MuLAZTnbg2EuznD5iAM93brXO0E2rhJE
  • TLSH
    T19A232A0037E8812BF2BE4B78A9F26105867AF6732603E54E2CC451DB5713FC69A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2