Extracted

• • Target
    791643422b96c015b9fc5435ec35caa8946036d1c7cd8eaff91654c7caab0642
  • Size 45KB
  • SHA256 791643422b96c015b9fc5435ec35caa8946036d1c7cd8eaff91654c7caab0642
  • MD5 d94fee109ed25e1c7434a512cea13220
  • SHA1 d6c091d7a34ebdbefb269b3fef9471cdfb690ca6
  • SHA512 04cc080e4ac6c8ca7d696bfda8c2ec70fd3651faa0ddd488ec75c113cbb372e38d53143d8be866685b260c2b36d1a45762be2fae7cff3903f543ee9418af4c83
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF93vO4iZMOPI0/zjbbg43iOwU6gvBDZUx:cu7e5TH2A2MmNM30/3bk4SttUdUx
  • TLSH
    T132232A003BE8C12BF2BE4F7899F26145867AE6632603D54A1CC452DB5713FC6CA526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2