Extracted

• • Target
    1a76c2e126e2b72fe5af286efa5da090280eef760f0f5cb2f5e7bdda5a455b68
  • Size 45KB
  • SHA256 1a76c2e126e2b72fe5af286efa5da090280eef760f0f5cb2f5e7bdda5a455b68
  • MD5 5017cb68e738ade5b2da1c221f1021ac
  • SHA1 c6222609271688c3f12119086dc3dcaed7a6a0d7
  • SHA512 5f1b8b1e110ef8dc52822916260bd3fe28fda80e42b68a57f15245d39c96b5c2b55670e0e3dd17e679f0e967ce964489440e50e12c6e2265e9275e2279f3b1a0
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAaLiE0yFjrdj3kk8PIhLjbCgX3ihvYlJhCtn83GBDZO:kuSOpTPOP2KLBXDBhfblXShvYl/Ca3I8
  • TLSH
    T1B1232A0037E8812BF2BE4F7899F26141867AF6733603DA4D1C8451DB5723BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2