Extracted

• • Target
    d64b407f6ef50e8bce86a42158afa58c8ce2891d34934aa5e27026869cd81db6
  • Size 45KB
  • SHA256 d64b407f6ef50e8bce86a42158afa58c8ce2891d34934aa5e27026869cd81db6
  • MD5 384d4e238a86dcf2f81f46a897b5985a
  • SHA1 8a6d93d2ca93e4f14a990d7a908a7e158a1acac4
  • SHA512 15b360f1c96778f2feab76c1aea21aba0958470a30df9de02ceab2281063898d649669a3cb9fa1f38b1124cc08774cc4bb2e7f5b2001ff849d8915a18f183a61
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qY2RzMwnOPIZzjbQgX3iZ3Hh/z0MjhNbBDZ0x:8uuSpTgyf2iA+3Z3bXXSZ3Hpz04hHd0x
  • TLSH
    T105233C0037E8812BF2BE4F78ADF26245867AB6677603D58A1CC441DB5713FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2