Extracted

• • Target
    292ed5e3a235334970e781a62c97126427ceb8631123b839550f5ebe4467b133
  • Size 45KB
  • SHA256 292ed5e3a235334970e781a62c97126427ceb8631123b839550f5ebe4467b133
  • MD5 54f6fd2e319f292a635e92cabe36e4ea
  • SHA1 291f01fdae3a2976dbd51a97455fbd9689a9bb35
  • SHA512 db3192c470f83abc20fc30b5736c25c580e32dee08a8fcc120a82f992a0c3eaa46f070fff98ab537667e60181beb91d4640d7a2a45f68a5a22b39e594ed771af
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9ah5BewwbOPIMQzjbogXfiuM3gNIeBDZsx:EulCJTHl4219F23MQ3b/XaLg1dsx
  • TLSH
    T126231A0037E8C12BF1BE5B78A8F26145867AF6673603D68E1CC451DB5613FC58A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2