Extracted

• • Target
    ce161a6b6d19aa5285bb755283df86c2155b6cbcf6d3b3fde0e6f31f4310d6e8
  • Size 45KB
  • SHA256 ce161a6b6d19aa5285bb755283df86c2155b6cbcf6d3b3fde0e6f31f4310d6e8
  • MD5 a2b2bd4287c9b1f94650701562a65be6
  • SHA1 7aa211b9ff0f0f9ff4d18e5cb9982a8f4125d515
  • SHA512 b7ef26c3e4e5dfc32bcbe47a665a364cdab7e987f0fe351642868d3fc05195d60d611266e2398170eeace5d09020841ad3cae19fa2602ecce7f16c6d7691cb3d
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNvozfy3CKPI0PjbwgX3ioaLqg6BDZ0x:5uSy6pTpoo2xTR07b3XSBGvd0x
  • TLSH
    T1F1232B0037E8C22BF2BE5F749DF26145467AF6633A03D5891CC4129B5613FC68A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2