Extracted

• • Target
    972271fd438f8b8ba9441f206509e0b945f7e6a54a4dff24d46a3014d890ab71
  • Size 45KB
  • SHA256 972271fd438f8b8ba9441f206509e0b945f7e6a54a4dff24d46a3014d890ab71
  • MD5 0a3a4f9d56bebb655f6e54f7a89afe61
  • SHA1 6182c16406c9ccb653271b2f6c29d0bd4beab0b4
  • SHA512 aaa669b04af6217f4af5945d6a9348150b0bd64ff685261d6a01de759d2111a81f75e9dde1510e4f2dcdea80b2c0d47be46834b082d54249495806440b47c2de
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAsxGZGP9HuPI5zjbDgC3ijpdpB0DO7JHCOBDZcx:UuKWgSJTwRf28Ga353bcCSVdv0DEHPde
  • TLSH
    T10D231A003BE8822BF2BE5F78A8F26105867AF5637603D54E1CC451DB5623BC6C6426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2