Extracted

• • Target
    f0ef27ffe7624480de77ff540664a7f9462a94c0e4fc69821fd2bd2d0e81416a
  • Size 45KB
  • SHA256 f0ef27ffe7624480de77ff540664a7f9462a94c0e4fc69821fd2bd2d0e81416a
  • MD5 e3c855b39cc26c43bbd9cf9f3485d9d3
  • SHA1 467c1b113c45d550f14f8bb3c21640c2a9f4cb43
  • SHA512 ec55e6f4473c3e486a9c17371553114993f306e9d010029b8c85c1b0c5998697548538d5d175152038799f6fba49aac78e61c75ca6fca68103a4cb5da3992218
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1zGsGx8OHuPI2zjbjgO3iDw0eXKaMagmSxQttBDZcx:RuxkJTgip2+ez323b8OSD5ehMagmSxQG
  • TLSH
    T13C232B0037E9812BF2BE4F7899F26145467AF2673603DA4D2CC452DB5713BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2