Extracted

• • Target
    477bcdb91079dacd67121f6809a870c7995286fe8ef751034b8ba5c2a39ad748
  • Size 45KB
  • SHA256 477bcdb91079dacd67121f6809a870c7995286fe8ef751034b8ba5c2a39ad748
  • MD5 02d4d2e0a77b58a4b7c83be464e89b3c
  • SHA1 f7a7628a949bf55965648790ee63d29ed16ae27e
  • SHA512 c73d20d0eb533620dacb85ae57e95c936f75c8723872e6203ebfcfcc1eae0ad389305f8ea323416cefa8bff97756bf856cebc03de89f696902f3fea6bfba84f2
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qln9xY6aZOOPIrzjbfgg3iWe/9Ykgc5kvCBDZMx:wuDWZTpMZSB2Cs/O3r3bogSak7tdMx
  • TLSH
    T173232A003BE9C22BF2BE4F78A8F25145867AF2A36603D64D1CC451D74613FC69A536EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2