Extracted

• • Target
    447b89012ecfe0892d3f4fa33379afd7d7f17904c8f031cd2a6866b0a8969a71
  • Size 45KB
  • SHA256 447b89012ecfe0892d3f4fa33379afd7d7f17904c8f031cd2a6866b0a8969a71
  • MD5 cabc4a2c4972da28404fc6cd0b642eca
  • SHA1 10d841f9243934aa657b03a46bff615d2582f815
  • SHA512 3900e33191e2e3c058587198be0c8434e55ddb2b3040b482c2ebeebdfbb71f3536e6c29c627ece17211d2466421960aec26205a13d8ddec0dce900e6a239b5f6
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qY7COtTMtPI2zjbEgX3i2i5Z1rG5MRneWL2BDZ0x:8uuSpTgyf2DRv23bLXSSmnVYd0x
  • TLSH
    T153233B003BE8C12BF2BE5F78A9F26145867AF5633603D58E1CC441DB5623BC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2