Extracted

• • Target
    527a238baa517f4446f961e00a967e2c485fc37e68d6c3635ce748b4dd2b0ead
  • Size 45KB
  • SHA256 527a238baa517f4446f961e00a967e2c485fc37e68d6c3635ce748b4dd2b0ead
  • MD5 57f7e2b4bfa010e90040a8cd8d6d20ab
  • SHA1 1349a2bfe80f0695755ca422dbd37b3e6b9f3de6
  • SHA512 ff6bde9ede91269118e0b51264efc1088d2e847f4b69a428226e7376cd069a170ec24d1ba0225a9ac1ad1b228136e5ee6f33bf740c6f2d551625519ec6015a48
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9oORw4iSXqNjPItzjbvgX3FQAVXS5PVgFg/tDOXBDI:EufspTf2g2BORD/qKt3bYXV1lcVgC/ge
  • TLSH
    T172233C003BE8812BF2BE5F7898F26145867AF6633603D54A2CC451DB5613FC6DA42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2