Extracted

• • Target
    408e1d21c565f324c5cb1f6e9bc1632c484af55b0e18760edff8c03b47a76774
  • Size 45KB
  • SHA256 408e1d21c565f324c5cb1f6e9bc1632c484af55b0e18760edff8c03b47a76774
  • MD5 8a81c1b4536ee142307324b1793bc96e
  • SHA1 faab967c3d94d13c61d212cba2f1f5871e0f362f
  • SHA512 e6860e48f31bd324d52e0a207804164f8850f07db443ecee660ada074f84f79ba1d9fda785a0eac29b3c6a273f13359b6c596ec6f6fba36e394e8f22406dc5b4
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFyls5ohEaMPISLjbMgX3itaixc+bKjCDhWl0BDZEx:MuLAZTnbg2X44EaxSfbDXSVtOCDhECdG
  • TLSH
    T11B232B003BE8822BF1BE4F78A9F26245467EF2777603D54E1CC451975623FC68A42AF9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2