Extracted

• • Target
    adec1fe1bbc87d028302c987a50568123e4d99e7e87a60283c4659416c7354b8
  • Size 45KB
  • SHA256 adec1fe1bbc87d028302c987a50568123e4d99e7e87a60283c4659416c7354b8
  • MD5 096583a7f4f479b9d1b82814b0d9863d
  • SHA1 82a10514909854672c5e6b955353617f53fed2b8
  • SHA512 3fc6c638f42e726eca987ebaba067d4c667541c9ea3dea8ac57db12de51436ffd8a141070727740ae130202756edccd540b929941332cf248f9f1c6a10452a40
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYhoRQKIJOPIhzjbcgx3idr9MealcIqAyZ9BDZ0x:8uuSpTgyf2JYxg3h3bzxSdr9NgcLAUTU
  • TLSH
    T15B232B003BE8822BF2BE4F7898F26145867AF2677603D54E1CC451DB5613FC69A427EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2