Extracted

• • Target
    d29e1be8d18c470054de7eb70b1bbd13f31deb6e81fa9efe2a5ab8070560d242
  • Size 45KB
  • SHA256 d29e1be8d18c470054de7eb70b1bbd13f31deb6e81fa9efe2a5ab8070560d242
  • MD5 753d2e580eef3dc586492fca9c3c2d39
  • SHA1 2adfcc86705c74b5bc55c3b3ebc232f3bd0f147c
  • SHA512 3160b962886a56f1e0e10fe97f4ab19a01c45cbe46baad520cff30a9c154f075d97dda664bff1d79ce85c0dd6c95cf08f0bf6b3c40c633d144dc880cdc1236f1
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVigzZUpx7PI8ijbNgX3i9LKbYncBDZkx:suJdpTPdI2Ton8ubaXS9ebxdkx
  • TLSH
    T1FF232A003BE8C127F1BE5F78A8F26145467AF6637603DA4D2CC451DB5623FC68A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2