Extracted

• • Target
    59e534937e717560cee9e13a9d1e8f8302ce47c540c65f03693126031491509f
  • Size 45KB
  • SHA256 59e534937e717560cee9e13a9d1e8f8302ce47c540c65f03693126031491509f
  • MD5 dde47c3f1fbcbaf2a3c49c8a62a18688
  • SHA1 aecb9d70ca706a3795b3a2024c225de855098653
  • SHA512 d8b0241932bb87aa1e7538e188afe363fd4db0406aa18dcbed7a349fea12e023243ec91cb3a6b533cb82d9df3a91e058e1ad8ecf8ae00c1c8c6389247b7b5b40
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtbx1HJhOPIcozjbugt3imv01cPU2BDZ0x:5udApTNmU2cFj3co3bRtSLbYd0x
  • TLSH
    T1FA232C003BD8822BF2BE4F7898F26145867AF6637603D54A1CC451DB5613FC6CA526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2