Extracted

• • Target
    c489a2f69af859b35d2cf23fdfefd8685b1c3a655c9b9426f7f09349f060fc89
  • Size 45KB
  • SHA256 c489a2f69af859b35d2cf23fdfefd8685b1c3a655c9b9426f7f09349f060fc89
  • MD5 93fdd5f9674a7275946aaf1bccbb59d3
  • SHA1 580cb8d89621178c7198f8a3ec1042bcb7130169
  • SHA512 74f9f002493a2bafc38d88780b63f104f2624513cf25b88ab880252a49ebf22ff6a7bc0b4de4187c3717b56f2bd2e8b4b9843c67378c24658bf64e1dc922d0d4
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF7SAFcKoabbb4ZhM/RPIAEzjbCgX3ik8kypcKO+32W:cu7e5TH2A2QSAvQZh6OAE3blXSMiJOIT
  • TLSH
    T14D232A003BE8812BF2BF4FB859F26145867AF2632603D54E1CC451DB5623FC59A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2