Extracted

• • Target
    62a34c05c846487ec53d2e6cc662a165d644b5578e782bbf246904c0b4ed8133
  • Size 45KB
  • SHA256 62a34c05c846487ec53d2e6cc662a165d644b5578e782bbf246904c0b4ed8133
  • MD5 c09de7b9ae1693a5583313ab2f130dbe
  • SHA1 67c6c6dbb99e02bd7c72f0a2acc6dc184907c87f
  • SHA512 3d83910ef1fdc24d61f36c8d74265647f749dfed415f8204991f0c93ce82d0aefebc92ac6d969ddee589a63af18ed7e03a4a053b8f35b5264c71c2db860e39fd
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9oozfy3CKPItBjbagX3iahIUVGfoMvmrWaBDZsx:EufspTf2g20TRtRbNXSIVGfocIWEdsx
  • TLSH
    T1DC233B003BE9C12BF2BE4F78ADF25145857AF6632A03D64A1CC411DB5713BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2