Extracted

• • Target
    f67dc1d8751803116c739ac58ff8781f02bf70f446451dec4def40accba32eac
  • Size 45KB
  • SHA256 f67dc1d8751803116c739ac58ff8781f02bf70f446451dec4def40accba32eac
  • MD5 1a69b3898311c1ddc8cea9cafc1aeef7
  • SHA1 e5fe974b996846430616f4ba57b7e0021644bc45
  • SHA512 0dc9387cdf95d4b40ccc81bcc44b93e5c13fddccc17b33ca282e99b9d53ae95f2b349f86ce55b6ee7f7232fce657090d68683d4e3b667869b48c966708edfbec
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlN3xY6AZOOPILzjbRg+3iYPvx2mEKxDBDZMx:wuDWZTpMZSB2MulO3L3be+SQJ2mVbdMx
  • TLSH
    T16E230B003BE8C227F2BE4F7899F26145867AF2A37603D6491CC451975B23FC686426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2