Extracted

• • Target
    f2af78e3c508258ced034ad0208ecdcc6d69260862a0cc2c8a55e066464d89e5
  • Size 45KB
  • SHA256 f2af78e3c508258ced034ad0208ecdcc6d69260862a0cc2c8a55e066464d89e5
  • MD5 a1832dd2cf87aa5c13f87703d5e57b39
  • SHA1 ac8dcd0dfd7d15c07a182bd5a5d30d558dda694c
  • SHA512 788b9bbbefc0574e043229975707527dbbfc3877d3481ded697af50698deb646af66ef9425b7d7dbc72a3bf2dd81b957a21eb48f1be22b6eff92e0a7ede25976
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q44O5QSCBzHSNjPI7zjbpgX3iJjdMTTFozBDZ0x:8uUIpT4vAj28O59ESK73bmXStdZVd0x
  • TLSH
    T10F232A0037E8822BF2BE4F7899F26145867EF6633603E9491CC451DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2