Extracted

• • Target
    c57417288da10fcaa35060d5025b4467a8b52d7353f35d18507dc854df3f425c
  • Size 45KB
  • SHA256 c57417288da10fcaa35060d5025b4467a8b52d7353f35d18507dc854df3f425c
  • MD5 fb55362659883220ae35d26b93ae4fac
  • SHA1 cb18a9125c5ba55dd05b8f55a2f0eb9bad9a6063
  • SHA512 bf83ff34efd463b2bca9024bebd1140e38d323b236ed5791c653a6a33f5a8bb23ceff81f686bb6a90a46089b88abad8a7143e2dfbba16ab05973079267315b47
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q11/D0CCMAR4np78PIcCjbfgX3i4wiGk37mGi5oBbqu:wuZ8pT1tc2MTCzwBcOboXSVILPBYdMx
  • TLSH
    T1B4232B003BE8812BF6BE4F7899F26245867BF6632603D54D1CC441DB5A23FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2