Extracted

• • Target
    98f7c22c3e698ae68093ed4e3c108e82355eb9cc45dc8acfab8d1fb7732c2b50
  • Size 45KB
  • SHA256 98f7c22c3e698ae68093ed4e3c108e82355eb9cc45dc8acfab8d1fb7732c2b50
  • MD5 3958274e04872f082effe3318661edcf
  • SHA1 7e69e1b1eff695f5cd883dc59f4f6dd35737df49
  • SHA512 c0c29e36b053571ffe5c49883047007e441d6178db0994218f22bd12ab02eb2ca5979a888ac24b45f74654eaa0245c0e433f4c20a4239cf98933be269ca9d9f1
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAI0e3+Kv18iZPIezjbVgM3ivDAY1etIMle9u0BDZMx:kuSOpTPOP263T6iWe3byMSvDAY1etImJ
  • TLSH
    T129231B0037E9C12BF2BE5F78A8F26145867AF6633603D5491C8451DB5B23FC68A436EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2