Extracted

• • Target
    f15714fab7fa982bf0ee159008a9827d9e01866128079c54321f600927ace7de
  • Size 45KB
  • SHA256 f15714fab7fa982bf0ee159008a9827d9e01866128079c54321f600927ace7de
  • MD5 e414f8db59e2c15b9fab2b39926a08ab
  • SHA1 1f771ce048101b3e3ee657435c72da14de90dca0
  • SHA512 58185aa5886fc88e6067b6aec5ce1900563043a4fd6bcb7fdb696597e03d48e8862d323eb8ffce6209cee4527e05440273d9bcaa9ed989a7e39882c7300bbc5e
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9m6R8aI6OPIXzjbKgh3inPdg/cAF2ni7v7IKSBDZ8x:0u1YJTHcw2Z+Fb3X3bdhSnPdgkyzUd8x
  • TLSH
    T115231B0037E8822BF2BE4F789CF26145467AF6673A03D58A1CC451DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2