Extracted

• • Target
    02ebdc8936a2f47b6932c786688117dee1b04eb6399ad698b14004b2c5c2541c
  • Size 45KB
  • SHA256 02ebdc8936a2f47b6932c786688117dee1b04eb6399ad698b14004b2c5c2541c
  • MD5 43ddde506b4e608c7670f81408ea8d5d
  • SHA1 7a8e058822601f457b1867357ba6d2876410b0e0
  • SHA512 748270024ca27f5eec6bef0f177e5556dca5a4b4f53819cae950bba6a5ceeddf694ed8a2523509674e7cf7f4fd41a0876fc13e0287a86a2064b7919a34dfb930
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9Xozfy3CKPItHjbcgX3ibaEzs4xo1fwBDZ8x:0uPrpT/qY2ZTRtDbzXSXzs4xxd8x
  • TLSH
    T122231A103BE9C12BF2BE4F789DF26145467AF6632A03D58A1CC411971713FC68A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2