Extracted

• • Target
    585665c2f16150f32649991e5267ae93ce4b8286636974700bb3509e3b7ec2b5
  • Size 45KB
  • SHA256 585665c2f16150f32649991e5267ae93ce4b8286636974700bb3509e3b7ec2b5
  • MD5 810c946581c32a5838d75d533f355692
  • SHA1 799efd03e98ff005ae749da2696030999e93ade5
  • SHA512 63f075afc53d6b7fca6bd50a342ab49f154db41abaa60258da315816f83bd16e5f95f1df74eeac2684d057fe7f96161eb694e2212fc22e6b5980d8b56ffbc12b
  • SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7dCSwTMSPI5TjbWgX3iBMUx34cFi7zGbBDZ8x:0ushJTDXgH2ogG5XbJXSB/FNd8x
  • TLSH
    T130232B0037E8812BF2BE4B78A9F25145867AF6633603D58E2CC451DB5723FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2