Extracted

• • Target
    adefa5d419379b202ce722317ebb6e9b6d737fe250bc20d323723c0d185d30f4
  • Size 45KB
  • SHA256 adefa5d419379b202ce722317ebb6e9b6d737fe250bc20d323723c0d185d30f4
  • MD5 386dc827ce848e93d55745814d9d47e6
  • SHA1 5cc3cdf5c86e06a5a090bdcb6e073985a262dc8e
  • SHA512 9b61f6b75485efc81bb90e2ebbc171388ef0a31b20e72fc2d90b7b5d130297e04893c4e3ce36dededaae794e814c6eec8dd3cca34808fa3e6e231733559ee056
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFPeeXK5oibbb6TN8/nPI6WzjbDgX3iQCAydR2w9fB0:cu7e5TH2A27eEqTNKA6W3bcXSHX/dUx
  • TLSH
    T174231B003BE8C12BF2BE4FB859F2614586BAF6632603D64A1CC451DB5613FC6D642AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2