Extracted

• • Target
    52555023fb78b743c4e7d943ac064f48375c75155b53eeade6ac48e254be1865
  • Size 45KB
  • SHA256 52555023fb78b743c4e7d943ac064f48375c75155b53eeade6ac48e254be1865
  • MD5 4a3f00b8551220b93572c4555f7deb02
  • SHA1 6a359fa53fcbadc4e7084cb15d96d994a8b13fa6
  • SHA512 70d2c51afe544415fe0cfa25f6c0f6e05a58498e41dc6dd1d0389e4c635e344ed057366a58b0308d74e9a4afe1c12d822db7540213e48f532ac8f9cfb7592626
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlL3xY6yZoOPI5zjbGgp3idD5IVAOBDZMx:wuDWZTpMZSB2OuPo353bZpSwvdMx
  • TLSH
    T1AD232A003BE9812BF2BE8F78ACF25205867AF1A37603D64A1CC451DB5713FC696526ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2