Extracted

• • Target
    0d03e4078d49e823f6e5d5cc22fdec356872ce752de8071e596259f358084ecb
  • Size 45KB
  • SHA256 0d03e4078d49e823f6e5d5cc22fdec356872ce752de8071e596259f358084ecb
  • MD5 2e347bae14addb9cd961b7446babdb6e
  • SHA1 e31a32f639e4ba68442aec1484ac242ef24f81fe
  • SHA512 454460239a978ca803548a915d3f4376443dff72e016947ee2cc8a75c0d3877ca025c5c43b5342148275c9204cbdf43280923d73b84877b45112739e6a0c8d47
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1mGsGxJOHuPIKzjbZg23iV7h777rrPrWIDBDZUx:cu6YepTPso2req3K3b22SV7h7PDW0dUx
  • TLSH
    T1D5231B003BE8812BF2BE4FB898F26145867AF5637603D9492CC451DB5723FC6DA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2