Extracted

• • Target
    705e933c2ce572e5f37b9d06a5e45f00cde7b193dc4987177e0d997e40076a6c
  • Size 45KB
  • SHA256 705e933c2ce572e5f37b9d06a5e45f00cde7b193dc4987177e0d997e40076a6c
  • MD5 2da09d8ed165873eda8cef069f791b2f
  • SHA1 ff721e9ca95ccac2cefa16eb14e6f510ac482300
  • SHA512 721acc5888fc8505b28f8146a3b4717b3a85af3c81c3300325b842fae1aa058fd52ce5913ca6ce1e801130af57af2ce3117bf4f1a276368ffbbb2ce7914b4e7b
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrXT9Qpm9PIYzjbqgX3ivpM+nZj+3BDZkx:vuogpT7I62AQY3b9XSxjZKxdkx
  • TLSH
    T162230A003BE9C226F2BE5FB89CF26145467AF5632603D9492CC451D75623FC6CA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2