Extracted

• • Target
    87cb92ae3ada8a2a1042812a01836ba61283b491d00b7d10b1531063b7e6e0d2
  • Size 45KB
  • SHA256 87cb92ae3ada8a2a1042812a01836ba61283b491d00b7d10b1531063b7e6e0d2
  • MD5 7d67654690101d147d0f65e49c784a76
  • SHA1 445c7f609414248b51d7d5be451c7ab6cc80898f
  • SHA512 8504abe72d29f408b7c726ff539912acc68195752cb9ad8400b2ebe2e99417d9806197ab5aeaec1596594173f9f31b9194d24f9423849640829b164fe02cde97
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrXmaPclm3API7zjbTgX3iNXoIWmlH+SIgUd3vBDZm:vuogpT7I62IfcE3l73bMXS5EmMSk3Zdm
  • TLSH
    T1D1231B0037E8812BF2BE5F7898F26145867AF6636603D64D1CC451DB4A23FC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2