Extracted

• • Target
    2c5d3175c7096436093dd84a1f1e6c49e3783ee3dc3b207f2ba193777d1b1159
  • Size 45KB
  • SHA256 2c5d3175c7096436093dd84a1f1e6c49e3783ee3dc3b207f2ba193777d1b1159
  • MD5 944694d47ff8923978d700eda6c615c3
  • SHA1 25f59c1093f1c4d40506f3a19f57201a8ce388c3
  • SHA512 64b79ecf638846ecd017c09866edc8c18bef0add4ded9c3f9c1a12627e4ce93f7f19299fd20c7889462c08991cb885549903c2a40da5cb4d86656626173bdcfe
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAW0ewtSc30oiZPI3zjbagX3ib/pzZWBfJMhedBDZMx:kuSOpTPOP24ww2iW33bNXSb/tZWBhMoI
  • TLSH
    T142232A0037E9812BF2BE4F78A9F26145867AF6632603D5891CC451DB5613FC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2