Extracted

• • Target
    685312ca2ce3656f6aad979a744622a5c71c09e63a0460db10b8981c86778ddd
  • Size 45KB
  • SHA256 685312ca2ce3656f6aad979a744622a5c71c09e63a0460db10b8981c86778ddd
  • MD5 0d3ccca58714cbf5e0b5ef98e62d6a59
  • SHA1 1a243e7da1994fbd7082816b538e1f58b53e9882
  • SHA512 2fffb45c17c421ad36bb7ece404fbf70fa009416b6e51b1c22ce54e058441957320e0b8077493b99a3e232af586f960e77e3e938b93348cd924bed5831930a36
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1qHUttXAPIV9zjbDgX3RV7Tfoasv8BDZcx:RuxkJTgip230rXlV93bcXBV3Zsvadcx
  • TLSH
    T18C232A003BE8813BF2BF4F78ADF26145467AF2676603D6591CC4429B5723FC68A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2