Extracted

• • Target
    53cce11dc46765439462fff5c822b292a5a6cea6e4a59f483179463788f0271e
  • Size 45KB
  • SHA256 53cce11dc46765439462fff5c822b292a5a6cea6e4a59f483179463788f0271e
  • MD5 4be3b30714e5a8e1d2ce887ee59bae2b
  • SHA1 af657727f1b5dbc592dac5294f5dbb3547578609
  • SHA512 8019f2f00ab6f87bceb6c0b5654bc2310445ec2fbf341046159e3eb9cc5fec2fa937b814723bf2f772bff11ba4a19fafb971ba541828a54d6d0dfd073d210342
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9oozHyvCKPIi0jbpgX3isIJjthqKdBDZsx:EufspTf2g20L5iUbmXSxthBzdsx
  • TLSH
    T159231A0037E9C12BF2BE4F78ADF26145467AF6732A03D64E1CC4519B5613BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2