Extracted

• • Target
    510f86cf8c4db239dc7a12fa398ac1d4d0c965dda188f2ce1e5ac34afb5cbbde
  • Size 45KB
  • SHA256 510f86cf8c4db239dc7a12fa398ac1d4d0c965dda188f2ce1e5ac34afb5cbbde
  • MD5 b4d6d484b1e03d5719876e05817fe197
  • SHA1 6251e7f23044b97b663626af5355d05222ff95b6
  • SHA512 21cfee7b6b1e221e11eb61ded890b77f83e5869cce587c2df4f285b0547e14beeaedcab14ed2a39cb2f20d3becc88f49c92bb17317b6357e4d1edc1c658d7cab
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1M8V1NpxkcPIyzjbLgX3ik6IiLHTEd2TBDZUx:cuR0JTPjY2P8VXvkhy3b0XSykEE1dUx
  • TLSH
    T15E232B0037E8C127F2BE4F78A9F26245867AF6732603E54A1CC4519B5613FC6D6426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2