Extracted

• • Target
    622e3de3c5b19fd0fba4c234c20038b2f3205ca97bb7adda1bf34e65d0ce11e3
  • Size 45KB
  • SHA256 622e3de3c5b19fd0fba4c234c20038b2f3205ca97bb7adda1bf34e65d0ce11e3
  • MD5 69078f2ee315ae4d694cf4631ab858e9
  • SHA1 572f1d09476bc309d47ecfc45e8798937338065f
  • SHA512 ff47fe926aadf6fa5aa62e3525d6f35310356be56560c186e1ac699a44f2c1a8fba4c10b852962a9c8d88f1afbc99734dee3829dc9ab336e6dea48b4a93229da
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9zx1HJhOPIcozjbkgj3iOJG/0O0oar3rBDZ8x:0u1YJTHcw2EFj3co3brjSK/oaJd8x
  • TLSH
    T1F3232B0037E8822BF2BE4F7898F26145467AF5673A03D58E1CC451DB5613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2