Extracted

• • Target
    dd97ade2921078e5665b1aceb41c099b0ea4a1b2f571c46d4320e790da89bda3
  • Size 45KB
  • SHA256 dd97ade2921078e5665b1aceb41c099b0ea4a1b2f571c46d4320e790da89bda3
  • MD5 d0102fca79da1312efa921a0aeb5bfd6
  • SHA1 62ed13b3cdabd9ccc9ea6a50583ca26acf254243
  • SHA512 42bf430fd800d4fe66bb43433dba702f8aee13d8d058b350a3e60dc241c1acbc8980e73d14e74a9092a9f7f85fe320651ebd09c6f7362ced0513f2bf221b17fa
  • SSDEEP 768:DuAqJT84XVvWUXR1Zmo2qjAcQSCBznqNLPI7zjb1gX3iD7Q19LIDgN1fBDZcx:DuAqJT84v23c9UqC73bSXSni9LIsRdcx
  • TLSH
    T1F5232B0037E8C12BF2BE4F7898F26145867AF6637603D5492CC451DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2