Extracted

• • Target
    a969e270694dfe43082c00d431f479a9cafdf527d22158416242afac0cf2a225
  • Size 45KB
  • SHA256 a969e270694dfe43082c00d431f479a9cafdf527d22158416242afac0cf2a225
  • MD5 fb1c252d9e5d05ef28c487717258418a
  • SHA1 865f2bf4839051b43b9f3f9b7a828a14eeb1a550
  • SHA512 d0f534f72d83dd73fbfa7e65a9faa95c17fe5ff745b206c631c36fd586cc61dbf8370d96c66b4f6d2f4185b5f5152baaec938faaa2749540678842bafe7f7083
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFV3xY6AZOOPILzjbTgs3iVyMRkRBDZUx:cu7e5TH2A2kulO3L3bMsSVbSvdUx
  • TLSH
    T162231A003BE88127F2BE4F78A9F26145867AF6636603D54A1CC452DB5713FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2