Extracted

• • Target
    39976988f558bf40e09ca53705d21d66ab89e22e7783122afa2d0267e736c9f5
  • Size 45KB
  • SHA256 39976988f558bf40e09ca53705d21d66ab89e22e7783122afa2d0267e736c9f5
  • MD5 fc90447ece92cc743f384d079bbbd4ab
  • SHA1 134a7a894abcf1ec08ad4b5e2a489dcd02055c17
  • SHA512 8265254bf145c4b051fc57a4d412c958ce5f5f438f580affe7cf332f9747322da6cdd3de28d289a3c6701deacb37efbd49f80ec2a527969ce9d61e3e36395110
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1nLiE0yFjrdjYkk8PIuLjb2gX3ix86tJKu1hLBDZMx:wuZ8pT1tc2KLBXQBufbpXSxSu1PdMx
  • TLSH
    T189232A003BE9812BF2BE4B7499F25245867AF5632603D64A1CC451DB5723FC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2