Extracted

• • Target
    579a9921a69f2fbfae6ebc23099189b55b4f0753f188f54ce422a1b39d72e11c
  • Size 45KB
  • SHA256 579a9921a69f2fbfae6ebc23099189b55b4f0753f188f54ce422a1b39d72e11c
  • MD5 188d8e613cac978557c46aa43f2d0e41
  • SHA1 02ce283b5741a33c4aeb34c4ccfcd0b179e94c29
  • SHA512 090e06699005ef64450ce96506f9f70f12ad3a2fc1af308c39628f2c1a3f8315650bf8964384075dec5bfa76d978272cb9d422c3e8a8a7f2705de03d503bb56a
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlcNd3u40cMOPI04zjbzgXQiHt6Pzxw4zYBDZMx:wuDWZTpMZSB2r8+M3043bsXtHgzxLze8
  • TLSH
    T19E231B003BE9812BF2BE4F789DF261458A7AF2633603D54E1CC452975723FC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2