Extracted

• • Target
    fda2cbdfde082b8975d0a5379c33af896cafd1e48e75e81a123d5d692717218c
  • Size 45KB
  • SHA256 fda2cbdfde082b8975d0a5379c33af896cafd1e48e75e81a123d5d692717218c
  • MD5 21c085810266aae3c776bda9823f13ac
  • SHA1 6b571df519033ad282076f850fe7ee62d7a9a370
  • SHA512 0e6266304e10dcf67a72505ec914d31b82f1f8504b1b15b9fd9906aac981ae9e4045ebd040cc5290bbcc6ddba1355e1d9297eb2710eed75c79224bcbccbc807c
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qj79YSkqXzNOPISzjb4gv3ibGE8CkCFNQN9BDZ8x:0u2vpTDe+2QaVq3S3bvvSbGnCkgCd8x
  • TLSH
    T12A232A003BE9C12BF2BE5F789DF26105867AF5732603E6891CC451DB5713BC29A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2