Extracted

• • Target
    0431a5226e6c6264478cd83d6eba5a05be88318e8d181b7765f3444a5942db5a
  • Size 45KB
  • SHA256 0431a5226e6c6264478cd83d6eba5a05be88318e8d181b7765f3444a5942db5a
  • MD5 5aed9072bdc777fedc8adab7b0065d1d
  • SHA1 1e6139d723ca801a6cd6a76528c3fda08e02b732
  • SHA512 bd008d204456c15233c26c855c92fba6f999955a52e3482a16958f4f254a9c4d2105eaaa87c5dd0f115a6ce31107b50650380986f011c1be9fd7aa10dadb0602
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qln9xY6aZOOPIrzjbjgw3ivqsCNyEismSCBDZMx:wuDWZTpMZSB2Cs/O3r3b8wSCsCNysmb8
  • TLSH
    T118233A003BE8822BF2BE4F7899F26145467AF6637603D58A1CC452DB5713FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2