Extracted

• • Target
    f487ba95cc5e54a57bf82a2bfaae53b218012f7a8029466b7dac2ec053cea6fd
  • Size 45KB
  • SHA256 f487ba95cc5e54a57bf82a2bfaae53b218012f7a8029466b7dac2ec053cea6fd
  • MD5 699c0671bcf685fea1ebbb6fd430d86f
  • SHA1 769ca321ddfbae5a9cf044671116d139e80aa2ca
  • SHA512 fc06406e33575b113499c3106029c5a47bbb6c825ed890279ac25491497ab86cda247110892250f3f8709886b5eaa7dbb718b7e8d57da3e97439bf0f18cd5059
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1nLiE02FjMdjYkkmPIQzjbOgX3izmW8zuulRiDJLB8:wuZ8pT1tc2KL9wQPQ3bxXS6h3l+dMx
  • TLSH
    T179231A003BE9812BF6BE4F7868F26145867AF5733603D64D1CC451DB1B23BC69A42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2