Extracted

• • Target
    7d1224b96ec751728faa77bcf702ba4a876d5301500d7bf6e45d2f714e509749
  • Size 45KB
  • SHA256 7d1224b96ec751728faa77bcf702ba4a876d5301500d7bf6e45d2f714e509749
  • MD5 91363b04d3ba46ab6178a936d5f867fa
  • SHA1 fabfc72b308d2eb749e8a66cb91a19ba3e2f838d
  • SHA512 3026c4381b92fdaacd3520d3832463e1d6458f3c565fac00018cd8c6ab0f26c0f460dc4903841445a7c97dfb61ac06183f9a3290dc695324cd82c526a933efff
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwe9xY6aZOOPIrzjbogn3iTdDilchU/zevzt63wLBDo:ku40ZTXEb2Ss/O3r3b/nS1QAOe7S6dMx
  • TLSH
    T143232A003BE9812BF2BE4FB899F26145467AF6B33603D54A1CC4519B5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2