Extracted

• • Target
    74011088c47f0e4a649c0f92b7193bb0acb9b80a1e340dfc57410386072f2e71
  • Size 45KB
  • SHA256 74011088c47f0e4a649c0f92b7193bb0acb9b80a1e340dfc57410386072f2e71
  • MD5 c14def3f50d94ac0d8c33b0f15a6db4f
  • SHA1 ef17e3a2babc922fb75cf4b7e3dc0010f92cca53
  • SHA512 182b39b2a0e1418f1bff168b35f419b5cce22bbe1a931fb3a2f3659a679d0b7401c532c65b69d0383b1d4eaf2fe3308c3c859c62ea45dd7f2d119e605c259ece
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtSCSwTMSPI5RjbwgX3iWVqoKGyc0OBDZ0x:5udApTNmU2lgG5Bb3XSWUGyc0Ad0x
  • TLSH
    T13D232B003BE9812BF2BE4B78A8F25145867AF5673603D54E2CC441DB5723FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2