Extracted

• • Target
    f92cb393fc8481dc2b2d17495f30f8bed0b733a64117f458608953c8d178a965
  • Size 45KB
  • SHA256 f92cb393fc8481dc2b2d17495f30f8bed0b733a64117f458608953c8d178a965
  • MD5 6e3ee42f4cc8c52059235aaefaad200e
  • SHA1 a511f10dc49af92ca93a90c216017246180fbf99
  • SHA512 34184b41f93a3f5f07c630a6c5b43ef1af53984bed139b78bcf56a4f2d34df3b788b81fdd4e392943ce76dab4d73c9b22c35ca8cc0124b62c5c9732586d48512
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1KgzZUpx7PI8CjbFgX3iQxg/OJipGuUIBDZcx:RuxkJTgip2Lon8ObCXSehJiouFdcx
  • TLSH
    T1F2231B003BD8822BF2BE4F789CF26145867AF6636603D54D6CC452DB5623FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2