Extracted

• • Target
    ec276b4b7f82a7b4f199b738881bedf75c30305426d5112439814ab6d0b8330b
  • Size 45KB
  • SHA256 ec276b4b7f82a7b4f199b738881bedf75c30305426d5112439814ab6d0b8330b
  • MD5 ae5bd7a3e34b96edf5504c7adb98fcd9
  • SHA1 5b8aafcb23365e4e31c2a66a2fe9c9c7bf38aade
  • SHA512 3624a4993cc754d487ff8a463b786efb9ac049279f2cf5277ddf02ba52c02ee3be46f07452e6b6864d79eca3231314795228f91d06902913f54f240815d446bc
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1N8V1RpYEcPIazjbQgX3iOcJ6t6khVp4MXHBDZUx:cuR0JTPjY2+8VDeEha3bXXSsrGOdUx
  • TLSH
    T168233B0037E9822BF2BE5F7898F26145867AF6632603D54A1CC451DB5723FC2DA42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2