Extracted

• • Target
    7a6d2da8e09d3f1621ede840c1020cb1ba50acc0d6fd5ecd525fdb14d7fab138
  • Size 45KB
  • SHA256 7a6d2da8e09d3f1621ede840c1020cb1ba50acc0d6fd5ecd525fdb14d7fab138
  • MD5 9157ed6a17ea66517e6a958912d195e3
  • SHA1 24df5b63d600c2e3669dc04bac02c331dcdc3a76
  • SHA512 ffb9bf943e3556d061725e8b23aa4dc853911bd5310eac9b10543dc3bc63522348c30a1b1f4185747adadd9ecec0e9fa0105e84629d043d8805a94a030e73d45
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFV3xY6AZOOPILzjbggj3iaKyT1jb8tiRBDZUx:cu7e5TH2A2kulO3L3bHjSaKyTtlvdUx
  • TLSH
    T1DF233B003BE8C12BF2BE4F789DF26105867AF6732603D54A1CC4429B5613FC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2