Extracted

• • Target
    835d126e6ff3da5478345207933198f186eae4e94770d5781f6375528c799604
  • Size 45KB
  • SHA256 835d126e6ff3da5478345207933198f186eae4e94770d5781f6375528c799604
  • MD5 505e7bbe841b49b6256f563bdf9f9e7b
  • SHA1 0631475b77d5cd5a3fe9c0043dbc460b297300ee
  • SHA512 caf3e25835425d625bcb8facfe32b0d7012050e7eb0348e63fb354d531f1d9803baa261a1229be5625edd7668b3552292b80797bbe16081a3b5d6d09b4ee1870
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYgCXtTtSPINzjbFgX3iYY+Ag9xZ4QmeIYBDZ0x:8uuSpTgyf24wxN3bCXSV+AgLGQmAd0x
  • TLSH
    T134231A103BE8C12BF2BE4B7899F25145867AF6633A03D54D1CC451DB5613FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2