Extracted

• • Target
    c3190a1bed1a80afb9778b6d31b9ec7a56bc90ed2be904bebfb795d09dd19c2f
  • Size 45KB
  • SHA256 c3190a1bed1a80afb9778b6d31b9ec7a56bc90ed2be904bebfb795d09dd19c2f
  • MD5 16cfbbe51f94cd92b1a70023832c9a89
  • SHA1 da594403d13dd22f877537135b6fe3b2d971f68f
  • SHA512 f81bfd41f801966ee5e8348c8cd31380e48c47f1c95e04ddeea23dececa9b792f6a8d9a6ab851bafc70295201f89f050c5bf90f28f473a6624f8ac94ea6b5f33
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9aELL0YjSOPICLzjbigX3it0phQtCBDZsx:EulCJTHl422bG3CL3bFXSuphw8dsx
  • TLSH
    T1CC232B003BE8C12BF2BE4F78A9F26145467AF6633A03D64D1CC451DB5623FC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2