Extracted

• • Target
    ab2604f9394f0bb4cb9ab33c85414764774284a83362c809d061474c145f62ee
  • Size 45KB
  • SHA256 ab2604f9394f0bb4cb9ab33c85414764774284a83362c809d061474c145f62ee
  • MD5 b6da163a2c7a02a5856d75b4026f1ea2
  • SHA1 d09dff001b7fa38159412f98c0c51e0c27c6f114
  • SHA512 af622486cd692a60d8128a3cd563a76a1653a468a0546952856f0102431cf2d49cc57c63649c824c78da9c95765ac13454c0065dfb422f760e66d5edb569006f
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2ql5AUdueMYl58FnPIMOzjbmgX3MOPFmgbhwD/BDZO:wuDWZTpMZSB2LUFpl5wAMO3b5X8OPF/J
  • TLSH
    T190231A003BE8C12BF1BF4F7899F26145467AE2732603D58E1CC4519B5623FC69A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2