Extracted

• • Target
    d91e73d43609cd9181d65c37ba4374d6741b39d95583592ade1dc916d7f47a3e
  • Size 45KB
  • SHA256 d91e73d43609cd9181d65c37ba4374d6741b39d95583592ade1dc916d7f47a3e
  • MD5 92a6036b7b5c2ebb939932d8b818965b
  • SHA1 eacef00d51673683af9268690664f0630cffd6ec
  • SHA512 d3ccd1201de58be9df810fb884ca8ed2c26bf304cf9b58ebafb39e8ef768a91dce48bc2d4f667fb16194e5859c3febfbbeaa3c9701b5899a4b31a158e8f02e4c
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwGeeXK5oibbb6TN8/nPI6WzjbzgX3ix93eYtUIDUNr:ku40ZTXEb2TeEqTNKA6W3bsXSb3t3aFx
  • TLSH
    T1F82319003BECC12BF2BE4F7899F2614586BAF1632603E94A1CC451DB5613BC6DA526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2