Extracted

• • Target
    ad38f64d4ae0c6fb3851c16ecdb74c8236f5de5add3583396ca8a2fe18718108
  • Size 45KB
  • SHA256 ad38f64d4ae0c6fb3851c16ecdb74c8236f5de5add3583396ca8a2fe18718108
  • MD5 b0454485a11f8da8ebe7bb4faf02cef8
  • SHA1 bf9c21974e9a7a85f55283f3fb0ad3e02913ab5d
  • SHA512 25f26bcfa035dff6998dafd2b0d78dcc0e5831eda6dc616c5f56415f52495417a84f8de4f6bf9d142a1f8278e0307ddbb4673f01f8d0fbb3433607aa4f794376
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qr8uwZQaKkPI7zjbRgX3iD6vOycf/5V0iduHBDZkx:vuogpT7I62hI73beXS2vo/7adkx
  • TLSH
    T193231B003BE8813BF2BE4FB89CF26145867AF5636603D98D6CC451DB5613BC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2