Extracted

• • Target
    ddb504eeea12ea470c87dabd6d35a590c784b7de7baea61c5149784206ddf5aa
  • Size 45KB
  • SHA256 ddb504eeea12ea470c87dabd6d35a590c784b7de7baea61c5149784206ddf5aa
  • MD5 d4f8ce9f82803c2686f99f4a39a92119
  • SHA1 59b2f6248b3ea1dbdceca558fac3caf77cb84c4f
  • SHA512 2e7eb388d383a5f380b7e2543690d14dd6012fc911ef7564889f54397ed51485417314cefc37a12e48638b2de5c89c8ed5a3cbc6d774f361f8f362096c89e767
  • SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qF/eeXKGoibbb6tN8/nPI6Dzjb9gX3iaT6ZGUDXnDZWk:4uLZZTUTn2LeDqtNKA6D3bqXSfZGU7ld
  • TLSH
    T111231B003BE9812BF1BF4B7869F26145867AF2732603E58E2CC452D75713FC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2