Extracted

• • Target
    dafef7be891d5b31ea4678043b2879cc0632571e0f8a56380243213d6f23eeb8
  • Size 45KB
  • SHA256 dafef7be891d5b31ea4678043b2879cc0632571e0f8a56380243213d6f23eeb8
  • MD5 6e78a8c84d6cd5423d860bb3e77b2878
  • SHA1 c4d8521e0f3e82eb06aca83751771147dc21fc88
  • SHA512 bfa222795512bac7d58842d390467409553ca147258ed432a9da6e28635044b64bd37e2e58625d015e8659392949972036ddd591b421ff26bf86f5b524589680
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlTSAFcKoabbb4ZhM/RPIAEzjbhgX3iEVYSmGxAeE:wuDWZTpMZSB2YSAvQZh6OAE3bOXSEubX
  • TLSH
    T1B0233B003BE8C12BF2BF4FB899F261458A7AF1632603D55E1CC451975713FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2