Extracted

• • Target
    07aa0ed92433a5bdc068ccc39c885cb2f28f5c94e9b493e20f782d1da6ff7e66
  • Size 45KB
  • SHA256 07aa0ed92433a5bdc068ccc39c885cb2f28f5c94e9b493e20f782d1da6ff7e66
  • MD5 fc92079a90eae0371f9c219ebc93cb43
  • SHA1 e8674e5e065dcd820808da9c360046bd7ebb2af7
  • SHA512 0a9d0b602788b2f60619ab19b2cd9faf181d28472eb655fb957ea61b073378fff32afbbd71b5d3eeb72d41c58c69826982557032e0b1a43ac331c94bbd74e5d3
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAjT2Qpm7PIKUjbjgX3ig5x0dL7k2lvY7AzBDZcx:UuKWgSJTwRf2GeK0b8XSgeXj/Vdcx
  • TLSH
    T1DA231A003BE8813AF2BE4FB8ACF26145467AF5636603D94D2CC451D75623BC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2