Extracted

• • Target
    24f2f720696f5caf0226908747bf33c6624e1be0f6c704ce64471e2a677f5a9c
  • Size 45KB
  • SHA256 24f2f720696f5caf0226908747bf33c6624e1be0f6c704ce64471e2a677f5a9c
  • MD5 e155f7d3b125d9bd3fb0fc2a37460672
  • SHA1 44f379a7c8cc7c9fe4c4bcb72e3662c9c53eaab9
  • SHA512 2ce8c0658aa9b1a28e22e5ab35ec394e446e9c2a35aef65a74a7d48710b8d2ed398a6307e63dc9fa3618105f3af23978586e12b976961ef0e82815ad0033eb46
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qV2maPclm3API7zjbagX3iqbJj8x9vBDZkx:suJdpTPdI2HfcE3l73bNXSo8zZdkx
  • TLSH
    T179233B0037E9812BF2BE4F7499F26146867AF6637603D64A1CC452DB4723FC2DA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2