Extracted

• • Target
    443ec0600d93e2e6fd5f837b081e00e0c0ef17ae98e411011a77707e9362e068
  • Size 45KB
  • SHA256 443ec0600d93e2e6fd5f837b081e00e0c0ef17ae98e411011a77707e9362e068
  • MD5 3fdf9c613cc35d659c34e1b78aba428f
  • SHA1 df36ccb6d818f36a553d8e5594c868f633bd42a1
  • SHA512 a8475f19e8a131dc6abdedf73135303377b1976f5d1673c343a1ed0ccd813572baacf4362f779cf47f76394374805e8f04a64442f412e70bfe73146c33bf03f5
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF4ZTohEaSPIIzjbDgX3iNAJry5INsPsBDZUx:cu7e5TH2A214Ea7I3bcXSOry5NydUx
  • TLSH
    T11F231B003BE8822BF2BE4F789DF26145867AF6636603D6891CC411DB5713FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2