Extracted

• • Target
    423b95c3f8d1b20322618caa9c87dfea5ec47014f6fe240f3995a6d63222f124
  • Size 45KB
  • SHA256 423b95c3f8d1b20322618caa9c87dfea5ec47014f6fe240f3995a6d63222f124
  • MD5 39c908e4754f61dd8130b35deafd6aae
  • SHA1 dc6c4fa3f1b34d8b598a00410d7d564353abf9b2
  • SHA512 4a3bca0c165dfdef97d39617a99c894c4a9a589d9c45ffc3a6df5e634f58024f415e6fa8057ea0cde0d880d0b1531225047814a6df3965d753e8119f759447ab
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qld3HE4eVoOPIGjzjbig13iOkPpo91t6mkbBDZMx:wuDWZTpMZSB2cU1o3Gj3bF1SOYoF6VdO
  • TLSH
    T109232A003BE9812BF2BE4F78ACF26145867AF2A33603D54E1CC4519B5613FC696526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2