Extracted

• • Target
    a36314258a6fd64ee990ffa61e46547d8f1ca066c49a466de78738246486e154
  • Size 45KB
  • SHA256 a36314258a6fd64ee990ffa61e46547d8f1ca066c49a466de78738246486e154
  • MD5 afc8be22a30b43bdad15c89c7e092340
  • SHA1 bd2246b4e567350e8f76ea4fafd61dfecc399bd3
  • SHA512 ffb099fbef3226530fab4b82ee01abf8212f98a268bf7df13e6a7a1c1d4d28a00a7b335134d98450bb2bdc4ded60b9a89e90c93c77fe8358752a54a00caee749
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQ0fBohEa+PIvdjbSgX3i/LW/zXnsaBDZUx:cuqb5TrhG2a4EaHv1bVXSTUXsEdUx
  • TLSH
    T150231B003BE8812BF2BE5F789CF26145857AF6632603D58E2CC411DB5713BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2