Extracted

• • Target
    585b58febf85835e3c2d825770975fe250ef81e2efdba2bce9e55dcc09577f39
  • Size 45KB
  • SHA256 585b58febf85835e3c2d825770975fe250ef81e2efdba2bce9e55dcc09577f39
  • MD5 50f6fad33d470dd599e134152d9cf2b3
  • SHA1 c42e022dfcaadcc75274fabeb2f5dbb1488240e7
  • SHA512 610a47ff03c626a929c35f0c3ccb066af14f1f890d10895f8d977ac0e1a6d04a9829dc66766ad0604aaedfbf2e5fd953116d6c189afa3b8da06a11e07467ab04
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtm/NYssPJZOPIczzjbKgXPicG5ZMVgvyXPBDZ0x:5udApTNmU2ZHIf3cz3bdXqcGcVIypd0x
  • TLSH
    T1AE231A003BE8822BF2BE4F7899F26145467EF5673603D58E1CC4519B5613FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2