Extracted

• • Target
    4344c5b7371b9efc7576436d1fa7bc38ce66dce6e7a3612307f2ab20b26e4b5e
  • Size 45KB
  • SHA256 4344c5b7371b9efc7576436d1fa7bc38ce66dce6e7a3612307f2ab20b26e4b5e
  • MD5 cf9e4b4acffd361f76325460b6aca15f
  • SHA1 c5152b2a32b0fbbb8a622a811654adf0c5c8fe7e
  • SHA512 ae61b8df7b9f4c5173aaac05ef01b6ae8eff677624035c3a0136da656101c71d1f60038930ba29fc2e97e85bfcd140ffaafdd8313e444943e9972b2137a0557d
  • SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qFe3XodEayPIazjbVgX3ix+uQpax/SRVxZ518VLBDZbx:4uLZZTUTn29UEaba3byXSx+uvpSRVvMD
  • TLSH
    T1CD231A003BE8812BF2BE4F7899F26145857AE6633603D54A2CC451DB5713BC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2