Extracted

• • Target
    dd70632d29fcf2000bafcde06bbf838f775ae74fdb09b4e9457792ddd6c77d1e
  • Size 45KB
  • SHA256 dd70632d29fcf2000bafcde06bbf838f775ae74fdb09b4e9457792ddd6c77d1e
  • MD5 d36e95a8d444fa24315e80e9948def48
  • SHA1 0bbc09672e80789c8c727b994360d7dbc7efd309
  • SHA512 fac58474e12d7e98c649ce4619215c035b2efd71a103aa7b5ce61720ad8ef34a931149e83e44bcbcc873c63d492ef764bd7ea5a78034f47e3976df571eb88568
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1xGju8eQlZwZPI5zjbmgXNiS3Ywb0kYJl0xBDZMx:wuZ8pT1tc2kGjuVGwW53b5X8S3YS0Jrt
  • TLSH
    T1CF232A003BE9812BF2BE4F7899F26145867AF2736A03D54D1CC451DB5623FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2