Extracted

• • Target
    993e119042b6fa8feecf6fde041c6dfc476893516274acc489cb7d09fd6381f7
  • Size 45KB
  • SHA256 993e119042b6fa8feecf6fde041c6dfc476893516274acc489cb7d09fd6381f7
  • MD5 e05c10d1fe823aaf42b76983fa1f5769
  • SHA1 eaea9c9ed2cf4cba5f0eb9191a733ea92f13030d
  • SHA512 f9157803edcd21b1cdf963a0e93dbd91cd6a38a439ba72bab536f22e219fab513238faa1f0c91fa581fc16f417bb3f964504df8735958304323c61efeff6e284
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYZ/cYssPJZOPIcvzjbJgXCiDZvqhl3fG7GC66utBDZ2:8uuSpTgyf2hMIf3cv3bGXrQhl3u7GBzQ
  • TLSH
    T145230A003BE8C12BF2BE4FB498F26145867AF6637603D58A1CC451DB5613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2