Extracted

• • Target
    72d9c7823235584a77071067f2fa2748998108431e46f6ae754fd958b8e6d561
  • Size 45KB
  • SHA256 72d9c7823235584a77071067f2fa2748998108431e46f6ae754fd958b8e6d561
  • MD5 bc8e51bcd0c3c271d5b1a87d84c60c83
  • SHA1 9e0903bfc6f4582ff31676baf02698aad4d474f3
  • SHA512 27d4526f6937f7bd60a7406a39a226fd2123ce1b6b3ab272e5430b040010774fa860f9f868a4df7408effd924b0b4b00313edb94cc7072c4c8289d8e0899a079
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1T/7ce3APIbzjbIgX3UjbY72eIa4poKbQcBDZUx:cu6YepTPso2+DT3lb3bfXEPdIgNdUx
  • TLSH
    T131232B0037E9812BF2BE4FB898F26146867AF5637603D64E1CC451DB5623FC29A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2