Extracted

• • Target
    a86e1996ed84cd366d66748551adb7a68593e455c2b48d99421d1014ab99d16e
  • Size 45KB
  • SHA256 a86e1996ed84cd366d66748551adb7a68593e455c2b48d99421d1014ab99d16e
  • MD5 5a5df7d4ca82949da348f851fb89ac90
  • SHA1 cc3a8bd08c7134231ca15aef7330408fd3a37785
  • SHA512 d4528ac7c4cbe8d70b195e8bf778cbbfa2207ec0fc41afe43f51f97697cac78b3328549c007ac8f091a6e773a973a15d83a88b5227e7151014d28543670eaa9b
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEa+PIvhjbmgX3iinqBDHMacM7BDZEx:MuLAZTnbg2Z4EaHvxb5XSinq1fFtdEx
  • TLSH
    T1BF231A003BE8C16BF2BE4F7858F26145867AF6632603D54E1CC4519B5623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2