Extracted

• • Target
    547130eb4506f32eb7a65d177d734b059ab7917729effeed9441149edf86127f
  • Size 45KB
  • SHA256 547130eb4506f32eb7a65d177d734b059ab7917729effeed9441149edf86127f
  • MD5 f10255d8272f184694da7245764c9eaa
  • SHA1 01e7c9f0cdbe468070d2ed80d09f134489d2e214
  • SHA512 29cfbec0f425c4a5bea1cfd56fc72a20f3c5d0e284cdd69c0bab1c1df55b858b280e68fc9f1deb58d6f36b52d202e0a0fa64f4034a915125678c64b0ef9378db
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4UITnyfaaPIgzjbJgX3iJoTKKtTkBDZ0x:8uUIpT4vAj2wEhg3bGXSW9Sd0x
  • TLSH
    T198231A003BE9C12BF2BF5F78ADF26145867AF6633A03D5891CC451971613FC68A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2