Extracted

• • Target
    75f05b132ab36c268851eb057c98b827ee02ee310a06d0c79e0fa256ef2a8482
  • Size 45KB
  • SHA256 75f05b132ab36c268851eb057c98b827ee02ee310a06d0c79e0fa256ef2a8482
  • MD5 8c6d8ac6e24dc21aac0f5446d6da4c80
  • SHA1 345c3cd951de9f805f8ae6a5f3481b7c1373718c
  • SHA512 3f3de4d989db8d8e814251040830f4aa9913f26d82cefb3fcb2a2872e01b4acbb4e483f8020c0adc76835b472889056eff625e1c2bf261abd3f0569a93a04802
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVz0ewtDcy0oiZPIuzjbKgX3iN96XM8DxrBDZEx:MuBGJTPho2GwRPiWu3bdXSj6XMwdEx
  • TLSH
    T174232A003BE9812BF2BE4F7869F26145867EF5633603D5891CC451DB5A13FC68A42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2