Extracted

• • Target
    5080d681a8c7b3e38f037532aece4dc8b244063c40355a4cfd2862e1fffbebf6
  • Size 45KB
  • SHA256 5080d681a8c7b3e38f037532aece4dc8b244063c40355a4cfd2862e1fffbebf6
  • MD5 e88bdec6628d52317a6a34087ee1c72e
  • SHA1 9116c79fc7ee5758e6cf99249b4be4be1326399b
  • SHA512 0da81940df263a4deb380f4d9f6a79c325670b6bd35dc3c173eac3fb24056dd154c07900c5b78c87f96820f9910c087854d688919446071284b06a7c895dcf7d
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYrZo3TMtPIQFjbGgX3i6z3V3iv7uckMABDZ0x:8uuSpTgyf2tU3QNbZXS+Q75VWd0x
  • TLSH
    T117232B003BE9C12BF2BE4B7899F26145867AF5673603E54E1CC4419B4613FC69A42BFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2