Extracted

• • Target
    2078c38b9f3c26fea82ccdb963c1fccb8cca64cfd82860b5c51574e0e6ac5cb3
  • Size 45KB
  • SHA256 2078c38b9f3c26fea82ccdb963c1fccb8cca64cfd82860b5c51574e0e6ac5cb3
  • MD5 2a2686aab3432247b87a58150191dfb3
  • SHA1 7643ad697d2e940afa0a1fcb99fbf3be059efcb1
  • SHA512 464009b58f259514a2da67c042d4637962b812866dfd9e71ba053663a5c1877d2b8905e41920dc1c1023a131ec080bff73638272ffcbda9198931866dac1f2dd
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAQBz3QKx7PIUjjbqgX3iMrPNXQVUB82ABDZcx:UuKWgSJTwRf2gV0UHb9XSmFYhTdcx
  • TLSH
    T134230A003BE8813BF2BE4FB89CF26145467AF5636603D54D6CC452DB5623BC6C6426EA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2