Extracted

• • Target
    5d2fed17bd6434a6cad8ef66e0d3e0ad15700648ed4a98f47a11379e55590478
  • Size 45KB
  • SHA256 5d2fed17bd6434a6cad8ef66e0d3e0ad15700648ed4a98f47a11379e55590478
  • MD5 97ebffdafb3a29f2bb709aab425f755b
  • SHA1 68e6965cb2368b55ad5030eb19a58ca9fbe0f786
  • SHA512 b947789f40227341694f945f220354c8c3ae9b566dd95e89beee435ef04107a44790189c5cab66822e54151f61f0034e6140228e47574024ec940bc19e9b1b2a
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlcNd3u40cMOPI04zjb2gXhi3tQBgQBJBDZMx:wuDWZTpMZSB2r8+M3043bpXw3tMgsXdO
  • TLSH
    T16B231A003BE8812BF2BE4FB8A8F261458A7AF5637603D54E1CC451DB5613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2