Extracted

• • Target
    a17c5dec30abff16044727af3386de0494f0fef62ca28c3cb3fb86d065dc526e
  • Size 45KB
  • SHA256 a17c5dec30abff16044727af3386de0494f0fef62ca28c3cb3fb86d065dc526e
  • MD5 98438482de9f7e75b0f459bb0d6137ec
  • SHA1 af82a93454c5171f95b6f0ed98b937c19a994af2
  • SHA512 3fd6f36e83b84db2a0a28af5b70c177d2b9f42d74dd29f2c8274c78bcb261323b6c7517737f306c45d7f3801cb65fcfdfcc5191c0395dddbed13a707644845bb
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1nLiE02FjMdjYkkmPILzjbhgX3iArsOYMZ1ZBDZMx:wuZ8pT1tc2KL9wQPL3bOXS0svMZ1HdMx
  • TLSH
    T13E231A003BE9812BF2BE4B7859F25145867BF2732603D54A1CC451DB5B23FC69A43AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2