Extracted

• • Target
    73067b73878dc47c597f2eb039cd5cee289803058a03355e94acfd5ef1b612fb
  • Size 45KB
  • SHA256 73067b73878dc47c597f2eb039cd5cee289803058a03355e94acfd5ef1b612fb
  • MD5 3af3510707cb741b531665c3f013c70e
  • SHA1 51b2db453e516f6825b860426d764489ae0d93b3
  • SHA512 e64c748c56b9699f836c6cd8fbe7ec65d348e1ddf62977d7a0188c2b9b25310db6ae313c8cc0c5d92c88fdec3cac8c0d90f6aa46b9017d55249b6d18ac0dcc15
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNrwD/y/aqPITzjbggX3iZgjcw17Wo9yo0lBDZ0x:5uSy6pTpoo2okhT3bHXSZgjDQo0rd0x
  • TLSH
    T112232C003BE9C12BF2BE5F789DF26105867AF5632A03D54D1CC411DB5623FC68652AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2