Extracted

• • Target
    42ec1c3bf36fe511d66db349a1bbb2b4bf8529ab157f872dc43d1468a80e6cc9
  • Size 45KB
  • SHA256 42ec1c3bf36fe511d66db349a1bbb2b4bf8529ab157f872dc43d1468a80e6cc9
  • MD5 88002ba51341c4a5a9d2b518149e7d52
  • SHA1 d135b714b6da7d0b354d86484d15e67c7d233748
  • SHA512 b60028b9e7c6d9a88d663372c5ea0463f97d31d9cdd3a98ba3db485ad45d4a56976940fd5f2bfec2223adeb1f895f222873caeed0844642dcb8d095d41bfcb02
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVMw0QbKXPIgzjbqgX3iF1Dyk1YsbhGbg4RBDZkx:suJdpTPdI2R8g3b9XSFZykGkwFvdkx
  • TLSH
    T1CA2319003BE8813BF2BE4FB899F26145467AF5633603DA492CC451DB5723FC69A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2