Extracted

• • Target
    70a18a81001e5baa2de84af604afcc5ed6a5e4cc5b0e031e4fbd1c33f3e60ba4
  • Size 45KB
  • SHA256 70a18a81001e5baa2de84af604afcc5ed6a5e4cc5b0e031e4fbd1c33f3e60ba4
  • MD5 80e22432f028a2692387cd63ec8cb8da
  • SHA1 6ee2848754a5c7847447fbd52d0dfb35f865d566
  • SHA512 0596f724cd1eff4afc5b43d8b23137238a1b095ff35e0c558cb8edea9c5dd6c050e1859d90c17d3facdfb94953cb983010b2b4640b60d755a8a2e6d14adadeee
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFyls5ohEaMPISXjbAgX3irAD4Lk0f4LfmIz3BDZEx:MuLAZTnbg2X44EaxSzbnXSrAsLk0f4Kz
  • TLSH
    T15E231A003BE8822BF2BE4F78ADF26205867AF5736603D54E1CC411975713FC69A526FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2