Extracted

• • Target
    f5e8432702b652f31831b5df7e615fe0262a2f9fa89a71bc20a2ebc0ae1af67a
  • Size 45KB
  • SHA256 f5e8432702b652f31831b5df7e615fe0262a2f9fa89a71bc20a2ebc0ae1af67a
  • MD5 ff7636688b7ab2c03dc25a8896b8f30b
  • SHA1 9cc13b4e9aebf3344f5e9f0894e9a89541083ee4
  • SHA512 4283968e79dc5b8f37b53ebf0cbc7a9014cea0a047a32e0f29207f62d5e221bf493de211afc53293149e29280b4ffc2860c11766704981388bc0eaaba3676f53
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qF1Nd3u40cMOPI04zjbEgXzivSbYZqaRovBDZEx:MuLAZTnbg2m8+M3043bLXuu6odEx
  • TLSH
    T145232B003BE8812BF1BE4FB899F261454A7EF2632603D94E1CC451DB5713FC69A526ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2