Extracted

• • Target
    f2eb5b5206ef724ee5c5c852ae6dfb06f9e2080d6b67093c0d8c0103dded4a36
  • Size 45KB
  • SHA256 f2eb5b5206ef724ee5c5c852ae6dfb06f9e2080d6b67093c0d8c0103dded4a36
  • MD5 077030afefd64b9d728ec5a3caa3d0a6
  • SHA1 74d93d6aff5fc68ca02251512710cd3e6aae477f
  • SHA512 8332bb006f072aa2519c77875213cb358ac2741647e3433a454f6c7c16a6e7565481df966a9a9743d528db866ef7e1df2f53ac877ba3afbedc32d882cb31ad18
  • SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7h/NYssPJZOPIczzjb9gXMiM4iO3JWAzbY7BDZ8x:0ushJTDXgH20HIf3cz3bqXpMfO0QYd8x
  • TLSH
    T1EA231B0037E8822BF2BE4FB898F26145867EF5677603E58A1CC451D75613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2