Extracted

• • Target
    a5303fdae2ad6a4bea25221e321147de81398c15f27e1bbe9c2fd65c4d916719
  • Size 45KB
  • SHA256 a5303fdae2ad6a4bea25221e321147de81398c15f27e1bbe9c2fd65c4d916719
  • MD5 554e8d104ad51cde37920557e8a82e5f
  • SHA1 64780a6c5a67b7613fce92c0801844fb8415d96a
  • SHA512 d327f3e45e2d44e4f1da5ffdfb972a4b36ec65f024522a4ced142a3ba9099510a85dc7e2ec3baffad8656172a04115cdb61bc0d616f36ab8a94a9cf9cdde6ea7
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAaLiE0yFjrdjYkk8PIufjbegX3ivHQ7m61K2jpot+B:kuSOpTPOP2KLBXQBurbhXSfgdit++QdO
  • TLSH
    T1FA232A0037E8812BF2BE5F74A9F26245867AF2732603D54D1CC451DB5A23FC69A436EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2