Extracted

• • Target
    088a94b4017de86a4a9cf345ddaf9217442eedc11a524cd64de08ec8eda6bd4c
  • Size 45KB
  • SHA256 088a94b4017de86a4a9cf345ddaf9217442eedc11a524cd64de08ec8eda6bd4c
  • MD5 91369fe02eeca101e9823eedd319adaa
  • SHA1 f5f15ce4573bdc35de7dee377523a902b3feb851
  • SHA512 722391c4a80c30b222238c38f838335fea194916dc5f097aad3c292c8be9891fe1457dca776aece0e27310dd900d79e1c7974de0183be0288d4194b19f9b4152
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1HmaPylF3APIFzjbtgX3iV3AFFSCHkXQBDZUx:cu6YepTPso2Wfyv3lF3b6XSV3Axk2dUx
  • TLSH
    T126231A003BE9812BF2BE4BB899F26145867AF1737603D64A1CC451DB4723FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2