Extracted

• • Target
    aba079220739c095e5990e496561a41a46e3a0d12507222d773baefd5103a2c4
  • Size 45KB
  • SHA256 aba079220739c095e5990e496561a41a46e3a0d12507222d773baefd5103a2c4
  • MD5 bd2d6d388e388efc6d858969c1acc8f8
  • SHA1 ad02190b3c946ecdb668b74668fa3a7be99093f6
  • SHA512 fcc6b22ea5f69cd9403955eaa8d848eda298a2452c722c52fc19d046f17dbfb6dfce47bacd6b11a793054d6fc7b6cb24b511895f062f03540b00e7af20db0b00
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4zS7synzuOPIzzjbGgXRi55IJ0Wre9BDZ0x:8uUIpT4vAj2nSYh3z3bZXAk0M0d0x
  • TLSH
    T11B2319003BE8813BF2BE5F789DF26245467AB6633603D6491CC451DB5723BC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2