Extracted

• • Target
    938a6630dba7cf3777850fa62e6c111518050680a83704e36b0851af2becbfa9
  • Size 45KB
  • SHA256 938a6630dba7cf3777850fa62e6c111518050680a83704e36b0851af2becbfa9
  • MD5 ddd289e61b1e808163ce4572b2279bb4
  • SHA1 195a69d5c855f2e7a1921300a0d4566004883afa
  • SHA512 cebdda0de59c874039a7f6cf9df03283f8028e3f4f283112ebd2f5201187fdb5124c71f9ab8b73676388cfb090056021d52c8a45f000ebe983fdb8d7163e1fdb
  • SSDEEP 768:4uBfJTMUyYUWUWBDimo2qVvLiE0yFjrdjYkk8PIugjbrgX3icbvQgQ8KyBP8o6B/:4uBfJTMpv2CLBXQBuIbUXSuQn80dbx
  • TLSH
    T1F7231B0037E9812BF2BE4F7859F22245867AF5736603D54A1C8451DB5B23FC68A436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2