Extracted

• • Target
    f8476778a810b78a00a70651f799ceefc98629d66845b22304a70d677ca98e72
  • Size 45KB
  • SHA256 f8476778a810b78a00a70651f799ceefc98629d66845b22304a70d677ca98e72
  • MD5 7db84eb75658a85e6aa471a48843fead
  • SHA1 d5eb046576ad4eb529a2f554dc5d2f739bf685e6
  • SHA512 4eada438509d7c37d0124561b6a44507464cfda28a20da17c04ccd4219058277ccbdb95af63949d35943e3265abd2512ffac1504b1a29f781a8b96726b31619f
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVD0ewUkA1MiZPI7zjbXgm3i0gDDnNNHIvcLDqBDZEx:MuBGJTPho2iwvDiW73bwmSPNHeS0dEx
  • TLSH
    T1DA232A0037E8812BF2BE5B78A8F26145867BF6736603D58A1CC451DB5613FC68A436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2