Extracted

• • Target
    5db527af7756e848a19ac8446bf36c21dc5df97fae49177dfeed122b9a2375d7
  • Size 45KB
  • SHA256 5db527af7756e848a19ac8446bf36c21dc5df97fae49177dfeed122b9a2375d7
  • MD5 2d35d1f877b153cb9ff88f55c94b4333
  • SHA1 4b93fc3f1aa3fa2704eed43824b78ad2c956b049
  • SHA512 2d6401751de2a5fb06a5b2f822894163f3bae1758642eeaed0e8425e8fc7da361812261936e0cc881b4c473e29e6021ae326ddd071606f9a6d5d646481614fbf
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFvlsHoPEajPIZSjbbgX3i5h09kBKcxYC16BDZUx:cu7e5TH2A2qeuEasZ+bkXS5hEkBpuCS0
  • TLSH
    T1AE231A003BE8826BF2BE4F7899F26145467AF6633603D54E1CC442D75613FC69A42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2