Extracted

• • Target
    c834cd237e60b1997a92e24b2de1f89c90538116b5b08acf67f30f1bc3bb9b6a
  • Size 45KB
  • SHA256 c834cd237e60b1997a92e24b2de1f89c90538116b5b08acf67f30f1bc3bb9b6a
  • MD5 906af7227ba23610d0d24024a5a0fcaf
  • SHA1 e77b7d6073834d4b6f0b391239c69c3b67790835
  • SHA512 1d4500de2ef7544a8c49c50d051cef5c0f52e053dc9927cfda5b7883f2abfd9baaa5a13861520fbbe3d08078e8edc6da1c9564c5113c66a0794cae4fd8325a29
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtbx1HJhOPIcozjb8gr3i6Qub2/2P8BDZ0x:5udApTNmU2cFj3co3bTrS0bAd0x
  • TLSH
    T12B233A0037E8822BF2BE4F7899F26145467AF2637603D58E1CC4519B5613FC6DA42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2