Extracted

• • Target
    1728423b0015831cbb17b45d6815d00fd40db294e54149efc8374c40abc4bcdb
  • Size 45KB
  • SHA256 1728423b0015831cbb17b45d6815d00fd40db294e54149efc8374c40abc4bcdb
  • MD5 d0b7a036a8f21f98ba779bca84ea2040
  • SHA1 f6873727895c6df5dcd794008db68a3d72ceda98
  • SHA512 6d345dea0c64f8deb9efaa7dfefa09e635ea125456e5d70a62b974278c1468f5da48f3e38191e3772ebc89287221d480a9e33e4d5d7115338a1ecc2100e5f275
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1lHUttXAPIMzjbggX3IJvEYlftNeYme9jJBDZcx:RuxkJTgip2c0rXlM3bHXY9tN//hXdcx
  • TLSH
    T1B3232B1037E8C16BF2BF4FB898F22105867AF2677603D6491CC452DB5623BC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2