Extracted

• • Target
    369244fb114ad6dbda1dfe2e3587e3c476335b41eca7e5e27f252053e2cc2b08
  • Size 45KB
  • SHA256 369244fb114ad6dbda1dfe2e3587e3c476335b41eca7e5e27f252053e2cc2b08
  • MD5 87df5cf742b95a6ca84dfbbd0e78f249
  • SHA1 210ecda7416c1e7521677f6bca95f3bb23ceee9f
  • SHA512 b13473472f0d56121a8eb215d60b71cae9a93d5abaf594ed48e8718a210b9df750cd68645a4f5c7e95f84be94f75a435614860c0692f37032bb6f7e2fdd70748
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9liaLzwJAOPIcFzjb3gXmi7jChzsiUstIJ+U5UXWe3:0u1YJTHcw2S5U23cF3bQXP7GzPUsaJrw
  • TLSH
    T189231A0037D8822BF2BE5F7898F26146867AF6677603D58E1CC441D75613FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2