Extracted

• • Target
    1aabaf36a5d81c514a85e0926e665ac865f965871e4dfc0abb755f2808cc6c47
  • Size 45KB
  • SHA256 1aabaf36a5d81c514a85e0926e665ac865f965871e4dfc0abb755f2808cc6c47
  • MD5 a59fcad947d6d8640e85bccb116b31dd
  • SHA1 018f87bf4d8b570fa774c61d7e57f93b49d34044
  • SHA512 917e67f16522908ccc7b4dcfa89888f61b4a3b517bd3c87065d67201056731f77fe139334b578f41d2185e32af2dbe5b124b6cb45983f9004175a226b247b9ac
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q97qz8yfzuOPI9zjbpgXOikTe0QiOMAiW/ejBDZsx:EufspTf2g22qQJ393bmX3kTe0b+9eldu
  • TLSH
    T1AD231A003BE9812BF2BE4F78A9F26145467AF2673603D54A1CC451D75723FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2