Extracted

• • Target
    870457aaec0addca524d8fe308fa3f1f795302e8b6df2e78fdf905c9fa456d73
  • Size 45KB
  • SHA256 870457aaec0addca524d8fe308fa3f1f795302e8b6df2e78fdf905c9fa456d73
  • MD5 997502fa2c7393b28ea3d2c1f1b25678
  • SHA1 b8790839358f6b0674505aeac94c731e12fc8774
  • SHA512 ee1fe9cdfc8b6acea4ea44c4e62ecba89840eb6d752f1a3f46d91d6e52f655f6a6d7e186a42f82dde3035554882e688569d1694cedf95b1e56a795973e547ec1
  • SSDEEP 768:QulLJTEs+EgWUKJTGmo2q9c583IkOPIdzjbBgs3iwaSPqAQGRrnofpg8MLBDZTx:QulLJTE9X2NAF3d3busStSPqw6fFMddN
  • TLSH
    T1B7232B0037E8822BF2BE4F78ACF26145857AF6673A03D58E1CC4519B4613BC69A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2