Extracted

• • Target
    74e38fe8dc033ebcfd414a24598c6f9c969ca18314a17cd4e311de4a926b9caf
  • Size 45KB
  • SHA256 74e38fe8dc033ebcfd414a24598c6f9c969ca18314a17cd4e311de4a926b9caf
  • MD5 aeb2ff9f381deee961851c1b13bc0790
  • SHA1 c9233b39930db6fe1cff28ab3ebe4b4687d05302
  • SHA512 2ef19b37de3b207c9b37e1b32d63ebe657068e162b09d070dfe12c5b9094c7d4e90151e10c78fddc81c7f0566f57dfa694e3f00ecf9db671c4efc722a5d6ec2e
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qj4ozfy3CKPI0fjbogX3ioyZ28qjOKBDZ8x:0u2vpTDe+22TR0rb/XSR2sUd8x
  • TLSH
    T112232B003BE8C12BF2BE4F789DF26145857AF5633A03D6491CC4129B5613FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2