Extracted

• • Target
    1ce3e0d32eb4c49d0973d57057cf1efafc164d04582384fbc9a614038a08b611
  • Size 45KB
  • SHA256 1ce3e0d32eb4c49d0973d57057cf1efafc164d04582384fbc9a614038a08b611
  • MD5 a51d6742f39f5623dcfa325717bfadc3
  • SHA1 4fe578eef2cdd753ef55277d13482df3b3716fa4
  • SHA512 1d4611cc9fba9c27162ec318a200454a37740ec724e53797d8ed5b1f02b144cbf4f2c79949b8d40deb5dc1f67e1eb245eae487a0e9a46b01a8578ffe49ce08d0
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1GcP0pycvHPIjzjbEgX3iFcW6Twj1lnjcBIs9BDZMx:wuZ8pT1tc2FccMcvgj3bLXSFcWhrgBIp
  • TLSH
    T1E3232B003BE9813BF2BE5F7898F261458A7AF2637603D6491CC441DB5613FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2