Extracted

• • Target
    586c8ebfa930f67eeaf3fcd44aba000134e0ca7f6bc66aab2ecb6ec909603908
  • Size 45KB
  • SHA256 586c8ebfa930f67eeaf3fcd44aba000134e0ca7f6bc66aab2ecb6ec909603908
  • MD5 be8e866a6058bc4f3507769d75d3e720
  • SHA1 7b78a6afeb03373d27444f2178d6196cd567031d
  • SHA512 69565d81a34e59b9d8c87b8af84db9a5071aa7a66bf60a08bdc6a1555e03afb8bfcecb4c2f7eb6e2867de331efad6c5dc2b991069560f9c8d20adce866367944
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qA010CnMQRPn98PIQijb9gX3iHy6nlc8OZhcchSkhj:cuqNJTLr62EtnbvBQubqXSjcThccQpf0
  • TLSH
    T119231A0037E9812BF2BE4B7499F26245867AF6732603D54A1CC441DB5723FC69A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2