Extracted

• • Target
    e042cd89e2c43ad78f0c3742711483dc4b052c6d4da9dd3449fe3d31c336014f
  • Size 45KB
  • SHA256 e042cd89e2c43ad78f0c3742711483dc4b052c6d4da9dd3449fe3d31c336014f
  • MD5 b95ae8dcccb13c839acca4d99601307e
  • SHA1 813dd34a4a9886c8437c661d1307e59e75265870
  • SHA512 4653b02b15bfa3e3e61c6600b715ce70a2a7fae71778cbc41f9c275a81fb77646edce6e59f11ae01603b5e2d6d7ebb80d54acd4354f3590373ffae350fe5ceca
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q17xJdxrPHuPIbzjbCg73i3Zpt+8KcZ+IELBDZUx:cu6YepTPso2exR3b3bl7S3Lt+e+I6dUx
  • TLSH
    T10C232B103BE8822BF2BE4F7899F26145467AF6633603D6491CC442DB5723FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2