Extracted

• • Target
    75c5331f0766678966686877c0a3d53f78dafbb73abeab9e486bd445ce275905
  • Size 45KB
  • SHA256 75c5331f0766678966686877c0a3d53f78dafbb73abeab9e486bd445ce275905
  • MD5 5c8f6699c5387d1e8f24819d3003327b
  • SHA1 5b16a29bfec239bbd317935cdf526250360d38c4
  • SHA512 4d2d9e724ffef6c4c471305848057c6328088661f6e40e108c893292f1be0d9a16af50d5c396a10e02057a912808cbdfab3a986b6a7fd0af8f086943367af936
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4wO5QyCBjHSNjPIwzjb4gX3iMdDOrHUPeobe4BDZ2:8uUIpT4vAj20O59ESKw3bvXSMFOrjobe
  • TLSH
    T108232B003BE9812BF1BE4F74A8F26145467EF6637603E9892CC451DB5713BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2