Extracted

• • Target
    519130acd5643f9de15e88d76d04c9e2fa473f7a4c6be31c94b3dd4cac038109
  • Size 45KB
  • SHA256 519130acd5643f9de15e88d76d04c9e2fa473f7a4c6be31c94b3dd4cac038109
  • MD5 53ccfe5a591fd5145f48f2a7b5220fad
  • SHA1 a6dc47f409c87eec2bd7655ba586eab664dfbb70
  • SHA512 e1ee0bad1e3192c82437e71ec81d9682575f937613e77ddc457ec38e838aec7f9e862dc5ea5d54a721bb9ca952c8f40713354da901579df797f18bb06eb35c05
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qA+VlcVl6GcPI+zjb/gX3ZkDhnAjc/EWndkHIBDZMx:kuSOpTPOP2OV2X6Gh+3bIXJkDhn1/E9x
  • TLSH
    T113233B003BE8C22BF2BE5FB898F26145867AF6633603D54A1CC441DB5613FC696926FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2