Extracted

• • Target
    a2102d00bcccc46e01d7c5418a279adf58bdded036e5aaccc9c019a291f549dd
  • Size 45KB
  • SHA256 a2102d00bcccc46e01d7c5418a279adf58bdded036e5aaccc9c019a291f549dd
  • MD5 b3006785d7218756bfba9fd4185fc2da
  • SHA1 7df477a17fe23e916f3132a5e9264d5032e0aa77
  • SHA512 eb85639d30826c89f54edb230eb2c4eddc428dc6722c1aa3777775461885a30f3d2044f3e9f434b0a84e17b533a634b3b0ec605a6345cfdecd7868d0ab669040
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYZ/NYssPJZOPIczzjbigXDiG/a5dbnBDZ0x:8uuSpTgyf2hHIf3cz3bFXeV7Bd0x
  • TLSH
    T1E4232C003BE9822BF2BE4F7898F26145867AF6673603D58E1CC451DB4613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2