Extracted

• • Target
    5f801ac75a88120577ab031d6415890a70bcd63d23e53d9be79a1ed51367272b
  • Size 45KB
  • SHA256 5f801ac75a88120577ab031d6415890a70bcd63d23e53d9be79a1ed51367272b
  • MD5 353c240f916d1f4813aa851e5b51ed90
  • SHA1 fe035ac543da308e77e471af7b3f096339350b06
  • SHA512 50f94eb9065d85f0c49f818ed9eef44b0ab2d56f4d49b208934a9e11b57fc7d9d4c9c04cf6f26742e34cdaaf2cb85848f556e28d637b35d8097e5c89f7bbc26f
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAvT9Qpm9PIkzjbugX3icW0/Q65CgbOOb/3BDZcx:UuKWgSJTwRf2hQk3bRXStuHFD1dcx
  • TLSH
    T1E9231B003BE8C637F2BE4FB858F26145867AF2636603D94D6CC451D75623FC6CA426EA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2