Extracted

• • Target
    7cf63649eb08229b719548e11f0077f60c54bb78df70bce42356bba41b169c59
  • Size 45KB
  • SHA256 7cf63649eb08229b719548e11f0077f60c54bb78df70bce42356bba41b169c59
  • MD5 634ff73ce4672734f52d35c7fbe72fd1
  • SHA1 89298c10a37acbac8a6ab6b6d9d365e80cbb71c3
  • SHA512 479ca376ae9e2982a5fcfb6218d93e4b28589463fb07a7d0829f1c84cfdab64ceba324476e0cdac664346393ac6d4d65412ad3033cecb32eb176532dcd904f5b
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qA80eUNEARViZPI6zjbhgy3iZiKmBqS1oBDZMx:kuSOpTPOP2uUe+iW63bOySdmcNdMx
  • TLSH
    T15A232B0037E9812BF2BE4F7898F26145867AF6673603D5891CC451DB5723BC68A43AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2