Extracted

• • Target
    385499893011e1ddf4b00d3988c2b028afc2046c95fc44f8d96d5f22e06fd694
  • Size 45KB
  • SHA256 385499893011e1ddf4b00d3988c2b028afc2046c95fc44f8d96d5f22e06fd694
  • MD5 4526f8f0241cb0e795dd6cfb07eb24c3
  • SHA1 4c9475fb15c8ba827bc9d4be26890c5e7239dbd5
  • SHA512 2555e262861247254412a60418ad8447fe853baa763ade87d5918ce7de586b1ca49e20b087f774473582f349d0f04f6ee5c4db1e9f3249c4fe42097a499fa6eb
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1tVllVv6GcPIRzjb9gX3NSptoz3H3KTmtTcWBDZUx:cuR0JTPjY2oV/N6GhR3bqXdGvSZc4dUx
  • TLSH
    T1C2233B0037E9823BF2BE4F78A9F26145467AF6633603D54A1CC442DB5613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2