Extracted

• • Target
    6142fc57bb4d79bfbecb21c8396c5a5303106268320895577613ac0b0012e6d7
  • Size 45KB
  • SHA256 6142fc57bb4d79bfbecb21c8396c5a5303106268320895577613ac0b0012e6d7
  • MD5 a37008ef8eec8d6926d532c45d76d77d
  • SHA1 8ec5aeeceb3cbd7b25872ba7707580529071c0be
  • SHA512 738f31fa095a1abfd6342775830fc7a96e54b610d205a409e3432875ebb8b6fc9b4098022a6ecc250600650e82722fb86a6f8c99ec692f2f79be06050a0ba0d0
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1HqJaxjwHuPIPzjb8Yge3iX/422Fh6BDZUx:cu6YepTPso2S3+3P3b6eSXX2IdUx
  • TLSH
    T1A0231A0037E8822BF2BE4FB498F26145867AF5637603D6892CC451DB5723FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2