Extracted

• • Target
    f99edc2be4397deae2f0aff143a82cd5ecc96d4be57ca6132026c48b497cb08b
  • Size 45KB
  • SHA256 f99edc2be4397deae2f0aff143a82cd5ecc96d4be57ca6132026c48b497cb08b
  • MD5 489c3473e095380e76f5d4c278d86c93
  • SHA1 d60a029f43e0406bb3b509611ff3b5ce2fb34cbd
  • SHA512 15fd93633b0a8e9eac84b9fbd510158100be2097a7ccce310bd3066faaf899eaba81b522f72331275afba74fdef41c8f2f0ac0379fcc08ab360361239a32fb53
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjTSi0ynzuOPIbzjbMgXji9dJ5q5s8BDZ8x:0u2vpTDe+2ISVh3b3bDX+9dJk5sad8x
  • TLSH
    T113232A003BE8812BF2BF5F7899F26145867AF2632603D6491CC452DB5713FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2