Extracted

• • Target
    642991091b9d8a6787fcdc416baa16038c0c0d436b3be67b56083c5bf9d3ead9
  • Size 45KB
  • SHA256 642991091b9d8a6787fcdc416baa16038c0c0d436b3be67b56083c5bf9d3ead9
  • MD5 cd2af3641e97883ae1534fbb5cf40e19
  • SHA1 80ecb45df70cb5735b70f38c9072de3ae4f87f3d
  • SHA512 b28c75dd40746b5da7da7fabd3cd244aa421be9987e4a1bb4952be4ff9ca8d771dfd290a17238fbabe8b2a5001a215166eec707c97065d308d954b91c16a5789
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYZ/cYssPJZOPIcvzjbkgX7i33FuFPEIynYBDZ0x:8uuSpTgyf2hMIf3cv3brXW33FaPEIyeU
  • TLSH
    T112231A003BE8822BF1BE4F7898F26145467AF6632603D58E1CC4519B5613FC6DA42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2