Extracted

• • Target
    87fc10b5d4bfc3c17574c85661ad67c9edea3745e9e15877adb293b8ac359ddb
  • Size 45KB
  • SHA256 87fc10b5d4bfc3c17574c85661ad67c9edea3745e9e15877adb293b8ac359ddb
  • MD5 f596ba02b20f3d6eaa0ba5c467019afb
  • SHA1 37061eba47daa1c97749f52a9855903f5a7eac5c
  • SHA512 bc72212f5d2d120f0119bf2a5551ed56949d8a5e2fb3269ef485a06d0534ae06c074e7ae114f1f9cb17351852f217f1b49d0f83a6b80e180a076b534a290b71d
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1bpMbVf8tPI4zHbUgX3iVuQVd3l2TXBDZcx:RuxkJTgip2yqh47b7XSVu6MRdcx
  • TLSH
    T12E231B003BE8813BF2BE4BB8ACF26145467AF2637603D5492CC452D75723FC696426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2