Extracted

• • Target
    89f1a92453f7737a64c73925b6a5627c7545f5b6959b29a827ce39769a0ff420
  • Size 45KB
  • SHA256 89f1a92453f7737a64c73925b6a5627c7545f5b6959b29a827ce39769a0ff420
  • MD5 110ed18246e19ff45eda860d5bf752ef
  • SHA1 5db9dfaf636d49b18a5676dbc50300b4df2d3a8b
  • SHA512 ffdff6e3b569e9b35e6b8c0b457c00f7cae47fb30170dc830213b9114898ae6df376cd680e28d793fc039314d9d053efb51ecb1e8055c3310adfcd7868b76cf4
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYEx1HJhOPIcozjbYgn3i6uuKcky67EBDZ0x:8uuSpTgyf20Fj3co3bPnS6uuXj67yd0x
  • TLSH
    T1F9233C0037E8C12AF2BE4F7899F26145867AF6633603E58E1CC451DB5613FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2