Extracted

• • Target
    403df23ad81761b7fdb2afc76888ad39e6ac7256be30d1a15aba629e9b2ec8cf
  • Size 45KB
  • SHA256 403df23ad81761b7fdb2afc76888ad39e6ac7256be30d1a15aba629e9b2ec8cf
  • MD5 30fe1149811646a7f3e72c46e178b779
  • SHA1 b9bf8bc4d54c6eb19d40bfadae4ec9082d2f4945
  • SHA512 92f3d6b9a3b4af3f2e3ccdfb4aa065211ee04b7c2a4624eb6a4acacd0a718df654b57c9974e449f0a20d31d16b9700a07b7b61b7d1f6b6475e4a36ae6da79258
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVCT2QAm7PI1rjb+gX3i+D2e6jRTxxvBDZkx:suJdpTPdI2+T1/bBXS+D23TXZdkx
  • TLSH
    T10E2319003BE8C12BF2BE4F78A9F26105467AF5637603D64D2CC452975623BC6DA426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2