Extracted

• • Target
    0adccc384124e37c261bae12af40598f5131979f0460410783548d980582c468
  • Size 45KB
  • SHA256 0adccc384124e37c261bae12af40598f5131979f0460410783548d980582c468
  • MD5 63ddc29e02a43769305cef0f9f1efed3
  • SHA1 708acccbc8d752c17f1082479ac597b83bc37a89
  • SHA512 9abf68504faacd868a7c7535f6300eedb8dd1856daaadf70d9fd98a2414a4d9a93613659ad5a2bfe506e2b6441d5d76cc338d3071e612948aef806eac39e9b8d
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9zzjHynaKPIsFjbSgX3ivArOqClgIvxBDZ8x:0uPrpT/qY2QnZsNbVXSvn9d8x
  • TLSH
    T15B231A003BE9C12BF2BE5F789DF26105467EF6632A03D5491CC412DB5723BC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2