Extracted

• • Target
    86f0de91e04e628fc711cd9062482cb62088ac5df39141878d5ff5c81506d3c3
  • Size 45KB
  • SHA256 86f0de91e04e628fc711cd9062482cb62088ac5df39141878d5ff5c81506d3c3
  • MD5 df54d370a98c0f4d017d329d85f47fda
  • SHA1 6518f093f891cc8400e7eb5c74142eef130b57e1
  • SHA512 1ec2ee1eaef9bccf4718196575675b2bbbd9d2e40054f3cd2f5a635a8bea5d3c69fef9c770e141791d4b31407d1769ae1276ad1c88b39bf3fc7a44b37edb4a18
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1emaPol53APIkzjbMgX3is23M1E6E4oHgpBDZUx:cu6YepTPso2vfob3lk3bDXSxmEnHA3dW
  • TLSH
    T147231B003BE9C12BF2BE4F7859F26145867AF2677603D64A1CC442DB4723FC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2