Extracted

• • Target
    f737f9f1199887aff2684ed164b443581ab1b55e4de8979ed015d51d1a6c33a9
  • Size 45KB
  • SHA256 f737f9f1199887aff2684ed164b443581ab1b55e4de8979ed015d51d1a6c33a9
  • MD5 0889aba177ebf2315a4f0356a453c80e
  • SHA1 860296747e7e9031dccfce875d844347e164fc32
  • SHA512 2b789f94993598925bfae7ddc0857d8737c54d5d8be78702287a111bb6d887471fbe40e197258ee64a9dac9b1e829eaf80c8ca8db2c3098fcd72f865486b1659
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNC9Yq3q3hOPI2zjbUgX3imfs37lxBDZ0x:5uSy6pTpoo2/aCq323b7XSdJd0x
  • TLSH
    T145234B003BE9C12BF2BF5F789DF26145457AB1633603D64A1CC451975613FC28A52AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2