Extracted

• • Target
    547c3c6e218152b478f3ef73fdc27dc2781ad51b94da45133e331d9e60b7ecea
  • Size 45KB
  • SHA256 547c3c6e218152b478f3ef73fdc27dc2781ad51b94da45133e331d9e60b7ecea
  • MD5 5f9f11abfe8de2c5d95944265027f340
  • SHA1 bd01973123128ce28b8f43a3aa258fcffe41eb0d
  • SHA512 6f7e55c2fc7294c1bc3fc6e5f10edf09ee18e9678e1c4f9c18462886f8b3ac50ca3a015c3ec741dce7ba946e0e445dfceef22b92277df0804220f4fded847fd8
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4UITnyXaaPIwzjb+gX3iQ3e/1x1ZO9jKBDZ0x:8uUIpT4vAj2wEZw3bBXSkgbSVUd0x
  • TLSH
    T151233B003BE8C12BF2BE4F749DF26145857AF6633A03D64A1CC452DB0613BC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2