Extracted

• • Target
    772add714aa90f3385a9fc9402c47fcbd2b527ec5411aa32995ca06dd3ddad13
  • Size 45KB
  • SHA256 772add714aa90f3385a9fc9402c47fcbd2b527ec5411aa32995ca06dd3ddad13
  • MD5 36dcda33d85a70e07072c1bc2bbe4aaa
  • SHA1 a353123fb16b668fb31b72a5b1d390f1d00fddb3
  • SHA512 ca793d8ef74b8a11609bddfa6ede3f50dc0d2edc6bc3048edc43de952000209e26f09c395b68a186243b0197b98670f387af831277bdd7852edb957fc8bd7897
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjMITnyfaaPIczjbhgX3iHlxTtnebBDZ8x:0u2vpTDe+2FEhc3bOXSFxRSd8x
  • TLSH
    T11B232A003BE9C12BF2BE5F7899F26145857AF6632A03D54A1CC411DB1713FC68A52AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2