Extracted

• • Target
    6284a0cb9dd5010e42f8ba721b786065b869732aa60e9224f818e5ccb8794ae0
  • Size 45KB
  • SHA256 6284a0cb9dd5010e42f8ba721b786065b869732aa60e9224f818e5ccb8794ae0
  • MD5 5740f12a4e867bbfaa589fd62b2e64e2
  • SHA1 c669b02b092c0af62087eb4461cb653cb681f6c8
  • SHA512 0eecd3fa36bdb6b1d7d32893440ea02242840ec3e3bd00ea810b95833d3aa0ccf06e15f901ab750aa0c5d5dca95e19c054acb4b7453c3b036ff5d93ffedd7cf2
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEa+PIv9jbmgX3iSWB1PYuBDZEx:MuLAZTnbg2Z4EaHvVb5XSpLYgdEx
  • TLSH
    T124231A003BE8C22BF2BE4FB89CF26145867AF6736603D64D1CC451975613BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2