Extracted

• • Target
    786bfa7940a3e1bc2ac158aa43dc6d966ba5c52e5fe75cad90c479469b93d7ec
  • Size 45KB
  • SHA256 786bfa7940a3e1bc2ac158aa43dc6d966ba5c52e5fe75cad90c479469b93d7ec
  • MD5 3b8688b8e07b55ba27481a7d1926ec49
  • SHA1 25f9b86cb1e1c3bcff953b9e9586e231ae2e3a6c
  • SHA512 a23457beb7714f8257ea1f04e157a985b1e2e165ef88a614f01c9ffc751d2c8067cccf26aae13b5a381ba7737f26da95a5533b47aea311d21aaaa02f8215da1e
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNiqz8yfzuOPI9zjbbgXcin+4l9x5+7IiYHH96pYxV:5uSy6pTpoo2fqQJ393bkXZnPrxE6UAKU
  • TLSH
    T1D2233B0037E9812BF2BF5F78ADF261058A7AF2633603D6491CC451975613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2