Extracted

• • Target
    b91196ebcec5321290a446c9f2f988a5a75c6b155c24ff61b23ef1495df94aba
  • Size 45KB
  • SHA256 b91196ebcec5321290a446c9f2f988a5a75c6b155c24ff61b23ef1495df94aba
  • MD5 17e5ef6b9106d89930f3b4f4df720036
  • SHA1 54917b2bf6743287c8cb5b4f57ff029a15b24936
  • SHA512 b994c3a3984f927062b44471f102aa20456e83860da935797dc1caca1feb61c99af7e3b8faeb53b66ecf6b22a6f5b6093d0585b7e490949e1900432393fe3894
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9liaLMwJAOPIcAzjbWgXFiOXmJNtL3YsCCXLn5eXs:0u1YJTHcw2S5n23cA3bJXUOsL045Akd+
  • TLSH
    T132232A0037E8822BF1BE4FB4ADF26145867AF5673603D64A1CC4519B5613FC6CA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2