Extracted

• • Target
    5f623c8dcfa5df2a2b4109956f1af96148b84e3531a8a07da8c7b69c5bb0b6d8
  • Size 45KB
  • SHA256 5f623c8dcfa5df2a2b4109956f1af96148b84e3531a8a07da8c7b69c5bb0b6d8
  • MD5 caf028d291c403798436b6a05bd2141e
  • SHA1 7d94a19fae7d50cbdc64eb6464b853007f531be6
  • SHA512 6d885d50f55cf636b95930ea82c60bae57b74465dc4f16b92367ca3ccf2b3fbbde97d8c10ceb91368700c4b88ce5f165d16195bf3e46d685ae7a31c03df881f1
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9nDEbHBOjTOPI/Tzjb/gX3iMOCCQkoA2tpwajBDZsx:EulCJTHl42IyYf3/T3bIXS0CY3dsx
  • TLSH
    T1F1230A0037E8C12BF2BE4F78A8F26145467AF6633A03D6491CC4519B5623FC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2