Extracted

• • Target
    80e6b8bec78212228df3e8dfe49c2a17cc14188648aef062be8e219b55a477a2
  • Size 45KB
  • SHA256 80e6b8bec78212228df3e8dfe49c2a17cc14188648aef062be8e219b55a477a2
  • MD5 0f53c9ad4902672e9afee68ff0035241
  • SHA1 10467f60a3876ce939a1cd1cba4dec96a9fa1495
  • SHA512 c56b6c4204b6f4cfd495bb02311b302f8e033416825c5f3bfe1804d51f67b3d099fbd790c1b6831c0d40e59772a3e2dfd1023037239db7a7ea317a679a3524e6
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9oozfy3CKPI07jbogX3id+xVuMW17fBDZsx:EufspTf2g20TR0vb/XS8xVupldsx
  • TLSH
    T1FA232B0037E8C12BF2BE5F78ADF26145867AF6632A03D6491CC411DB1713BC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2