Extracted

• • Target
    540454d5013544b2bcb0bff1b9356d9b9e24e76abd2cf5303b206d1ce4f58b9f
  • Size 45KB
  • SHA256 540454d5013544b2bcb0bff1b9356d9b9e24e76abd2cf5303b206d1ce4f58b9f
  • MD5 191f6ffdd3fef8e3c2e1ab084846c78d
  • SHA1 a117c0698d7723659e673dc79e1ea01ee1a9c9f0
  • SHA512 175a6caad2dc1f0d1eae8ef34eb801b92fbb54a758f309cd18d7007a8641bd14cd32e9a70188f265b7de2d141f5f628ced25950288a58bce7a684006b12aa1f5
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9x/NYssPJZOPIczzjbpgXMiZS1oIdI/e1cYN/tBDZsx:EulCJTHl42eHIf3cz3bmXpSdos7N/jdu
  • TLSH
    T10F231B003BE9C22BF27E4F7898F26145867EF6637603E58A1CC4519B4613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2