Extracted

• • Target
    05a9b30609ca71f4b834f7c004223c8556032d8b228a2a12015fbadead06c074
  • Size 45KB
  • SHA256 05a9b30609ca71f4b834f7c004223c8556032d8b228a2a12015fbadead06c074
  • MD5 7f8cacdf3b69f12db2e532ba7843f29e
  • SHA1 91641bcc09f4a53f48204864077348ddfa7fa7ad
  • SHA512 78ed7784168a0c21cb55b89a42c239c3d8525bb52ac1a2fd3e366bf83fcb7a3a1b62eea9f401bcf5097259ea18e4b3e9424aff0aeb99c1c5435f4cba7d45377b
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qV+xJdxCPHuPIXzjb4gb3ig7M6giYOSIaS5OtPiBDZkx:suJdpTPdI2DZc3X3bvbS16gdL1cdkx
  • TLSH
    T1B42329003BE9812BF2BE4F7898F26145467AF6633603D64A2CC451DB5723FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2