Extracted

• • Target
    42bcde96fe3fbea9b0e510e2262814f79c3acd0cb3c96b312336a136913636fb
  • Size 45KB
  • SHA256 42bcde96fe3fbea9b0e510e2262814f79c3acd0cb3c96b312336a136913636fb
  • MD5 4991dcf42f1da1c87486d1634717c31a
  • SHA1 0a838509a6911480bbbb07f24edfca999851b938
  • SHA512 42237d2ddd2b75bfba0c65c5b529f010035d71acbffbae5952d9339f94e38534c026d933c255693e9e06f4caad34ed177012b6522dcffd32b68d59ae9d9bc3df
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrXT9Qpm9PIOzjb8gX3i/SfgrZy5edKql0wEEYFHBk:vuogpT7I62AQO3bTXSKOZy5ZqzEEadkx
  • TLSH
    T1D8230A003BE9813BF2BE4BB89CF26145867AF5733603D5496CC451DB5723BC68A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2