Extracted

• • Target
    605030e92e60412c8d661668bed34260ba70357a4dcffa97e4a231f988ecb6ea
  • Size 45KB
  • SHA256 605030e92e60412c8d661668bed34260ba70357a4dcffa97e4a231f988ecb6ea
  • MD5 dde189fd38bd5c1db8f51ae8f304d263
  • SHA1 f0da9d809ca821920d14d907dc07a12d9fc400db
  • SHA512 9bcc68a23f4dc7ac706690bd3a90acfa5b6044d1590b4d78f7bb0dd293fcc260767ffef8e214b7d1db286bae756ac1f9d269e1b4308f9281fe6799369c728fa2
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qV1xGZGP9HuPI5zjbPg23iFtPZtGnNX06q2BDZkx:suJdpTPdI2UGa353b42S7wF06qYdkx
  • TLSH
    T1142329003BE8812BF2BE4F7899F26105467AF6637603DA4E1CC451DB5723FC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2