Extracted

• • Target
    a34d2ea632fe43acc0b7a222cb8f4ec824394c2289a46720a758b8d94186b1da
  • Size 45KB
  • SHA256 a34d2ea632fe43acc0b7a222cb8f4ec824394c2289a46720a758b8d94186b1da
  • MD5 cd3172ad7d69360235d52476e4590d0e
  • SHA1 a6248596b9abbce42fd8bc92c4f5d5b3f7728725
  • SHA512 4feabe87f4a87271e54ae198439b82609a4b13d8f34d05f5211ce0600efa31136aaf6a0f204d1716927eec1f90d7203d30850de17b2c6266e78fa2635c7d27fd
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVpuwZQaKkPI6zjb8gX3iHHKvRThVLhG67kBDZkx:suJdpTPdI2QI63bTXSHqJDhredkx
  • TLSH
    T1BD231A003BE8822BF2BE4F7899F26145867AF5637602D94D2CC451DB5623FC6CA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2