Extracted

• • Target
    610ad41092ecb616067024d3d4ae4292b4c6f0b611a02b0e5fb579b24d2d462b
  • Size 45KB
  • SHA256 610ad41092ecb616067024d3d4ae4292b4c6f0b611a02b0e5fb579b24d2d462b
  • MD5 39a96aded5f78eba7bd0e10b1d407ff6
  • SHA1 490223501204b0e5b4ea3c4eccb74ba817bb6f48
  • SHA512 3c21a273b5077460f17ddbc40cfe0fdb8203a621ec8e1c63f4f4b33507a00d57693499355a72cf60a2186ca0c8d18224b4210ea107c71aaf76fbae7b237cbf4d
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF7fBohEa+PIv3jbsgX3iUOa7lpPgX6YvBDZUx:cu7e5TH2A2q4EaHvTbjXSLXzZdUx
  • TLSH
    T191232B003BE8822BF2BE4F785DF26145867AF6672603D5492CC411DB5713FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2