Extracted

• • Target
    82ade018ebe455214512a9315964ce8087b0f2643121d393c59298327f199221
  • Size 45KB
  • SHA256 82ade018ebe455214512a9315964ce8087b0f2643121d393c59298327f199221
  • MD5 1869f8444f2beef36d220f1d54c791ac
  • SHA1 dbe53d04c19d7001a535dd5949710e5c74893548
  • SHA512 4739ff05152ca0135a651b62506b2f55ca7c150a1f7626e29b92a1782465f6daf1423c796b80a91545aded0fbe863f4e46af06e93a058a0061885bc5b1dbdf6a
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qN9O5QyCBjHSNjPIwzjbpgX3i2pgys1g60BDZ0x:5uSy6pTpoo2MO59ESKw3bmXS2X6Cd0x
  • TLSH
    T1B5232B0037E9822FF2BE5F7498F26145867AF6633603E54A1CC452DB5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2