Extracted

• • Target
    56fc7c570e6aa0cc4b628300b898591f225d22130871dd274c1c4953c8b709d4
  • Size 45KB
  • SHA256 56fc7c570e6aa0cc4b628300b898591f225d22130871dd274c1c4953c8b709d4
  • MD5 8dcb381bd87afa567ed65fd7f409e015
  • SHA1 04ed63e7ee1ce9c8d64e12cb52a3e827857c6479
  • SHA512 746eeb30a58c8d217a883efcf3c59ba9084d6a419bb6c94e13bcdc48115d4667bfc73d840786e6600ea9e368a35842da988566c46495b4c260f31f7c69550ae2
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFG9xY6aZOOPIrzjbygZ3icZDrv7roqINkKyBDZEx:MuLAZTnbg2Ds/O3r3b1ZSivONudEx
  • TLSH
    T1A0233C003BE8812BF2BE4F7899F26105867AF6677503E54E1CC451DB4623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2