Extracted

• • Target
    7ce01432701546871c0d50ca3cd659939ec6cdcd5b2bf4f744805609fec867cd
  • Size 45KB
  • SHA256 7ce01432701546871c0d50ca3cd659939ec6cdcd5b2bf4f744805609fec867cd
  • MD5 718376972f6add427a028ac10bf1d8cc
  • SHA1 87ea65ad35f4a3792fcd9fb208c79e5fe9db9559
  • SHA512 2f840804afbaffbdbf4c6cd54a6c431e1f5abba26e7281651105e8e00d5a011424adcaf61480b3185f0119bd62f0b00b5c0af246e847387c825ee080832381cf
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fLiE0yFjrdjYkk8PIu7jbmgX3iGRxUw7i26YlRmLB0:cuR0JTPjY2SLBXQBuvb5XSGRBiNYlRw0
  • TLSH
    T1E2232B0037E9812BF2BE4B78A9F22245867AF6736503D64D1CC451DB5613FC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2