Extracted

• • Target
    b92a226690bca7eea5b8670cebaea342ca403602bdf62b9f0f9e93df792ac984
  • Size 45KB
  • SHA256 b92a226690bca7eea5b8670cebaea342ca403602bdf62b9f0f9e93df792ac984
  • MD5 170e52b3a3fdb54f3b82065c8f0cf20e
  • SHA1 1b3458dd484d060ce98948da6b4fc5051fd1772b
  • SHA512 2fd5737a6927aefe5746479b928c27f8237b18548cc407189cc13384c8b78ab04f75819caaa4de38374fdba28e1d0018e21371194929eee0f2e6ca3591fcfe91
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qj79YSkq/zNOPIFzjbZgg3iL0sVZplRuTBDZ8x:0u2vpTDe+2QaVC3F3b2gSgsVna1d8x
  • TLSH
    T111232A003BE9C12BF2BE5F7899F26145867AF2633603D64D1CC4519B5723BC28A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2