Extracted

• • Target
    25ed5008767e600cd0a7038fe36071b132760f6737b7a6b055c8906f750b2a79
  • Size 45KB
  • SHA256 25ed5008767e600cd0a7038fe36071b132760f6737b7a6b055c8906f750b2a79
  • MD5 9cdbd2b17ef7cc0d4f6ec0c5f46ac5da
  • SHA1 aec60052bbe3aa11dece38ac99786c00b7243983
  • SHA512 16c48f51d4bb29d9cba76cc7c331ccda5598af6340ea4f8bd573fe5a756ca338358a58279a68d0e6f9415f9b29ddeb606b2840ce2c96b0a4c35131e331d5c58e
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNDIz/yPqiPIJzjbtgX3i81RmOwZ+baG2Y4H1TBDZ2:5uSy6pTpoo2gc5J3b6XS8eOwsapJDd0x
  • TLSH
    T10C232B0037E9C127F2BE4F7899F26145867AF6673A03D5891CC4129B5613BC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2