Extracted

• • Target
    94a13dd89e7e16b11d68c911fd5dbf048bb3edd14793c4b25bc0a59b8f0eef02
  • Size 45KB
  • SHA256 94a13dd89e7e16b11d68c911fd5dbf048bb3edd14793c4b25bc0a59b8f0eef02
  • MD5 307e933c1753b5992168f9268d4457fe
  • SHA1 dba4fbc684d899430325d8951386ace74e3542cc
  • SHA512 215bbdb0142ac3630dea69b831c26fde1237f7d8cf60cb2f8edef6bdf5b39089e435499e7e4c26fb49e1ca636c1963348f98f88a9eda46433a0d2bb9e05bc883
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qV/FpPklON8APIDzjbegX3ie0TZduVdaBDZkx:suJdpTPdI227kwN8lD3bhXSe0TjcdEdm
  • TLSH
    T135233B0037E8813BF2BE4F7898F26145467AF6637603D64E1CC852DB5723BC69A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2