Extracted

• • Target
    f800d9f4bce4cb498fd8b24a2d0d0b04490974fc628128465a6faecd50be4e64
  • Size 45KB
  • SHA256 f800d9f4bce4cb498fd8b24a2d0d0b04490974fc628128465a6faecd50be4e64
  • MD5 f544856f9b1c580b4a7069959c53e4d8
  • SHA1 c3595a51ec1ab8fe2567c0b0dea8f21841e0f584
  • SHA512 81d2b93967caddfa7f9f653ab6be887baf7a3541f044826c1584773e88b54c6914df3d868c65dfca960119aa3023a1fe1e51489c216cd477586b567b2bdfb186
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQGseXusMkFX8vnPIMvzjb3gX3nBlWku0UBDZUx:cuqb5TrhG2VeB1FXiAMv3bQX3BNcdUx
  • TLSH
    T131232B003BE8C12BF27E4F78A9F26105867AF6632603D95A1CC451DB5713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2