Extracted

• • Target
    f01899cbc5d3780c537c102104844e708fae2d60d8e9afb8c5df49490f1d8b1e
  • Size 45KB
  • SHA256 f01899cbc5d3780c537c102104844e708fae2d60d8e9afb8c5df49490f1d8b1e
  • MD5 96ccb8e1a8d3205e032284738053c58d
  • SHA1 98a6180b55a9ab8c1a62468087a5961d9032049a
  • SHA512 37db3cf42e49c67627a09dfb805450ff231bbbb25bfe0808125f6d28617b16215380a603df6322de9ef1ad8dd9a3d2789d754d6654d7dcaa60d03cf010329b08
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1Q0ewUkA1MiZPI7zjbhgo3i0uTSpspk3PBDZUx:cuR0JTPjY2HwvDiW73bOoSfuj5dUx
  • TLSH
    T1E4232A0037E9812BF2BE4F7899F26145867AF6736603D58D1CC451DB0623BC69A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2