Extracted

• • Target
    26fe092ba79c57a625f1c4232b9f0554e18ad15f936bcf81e486adb24a81b69e
  • Size 45KB
  • SHA256 26fe092ba79c57a625f1c4232b9f0554e18ad15f936bcf81e486adb24a81b69e
  • MD5 28fe7b9ebed471ef1420343f8e1c3917
  • SHA1 8422e4172560e589eaa6b01a92aabf0fbb7bdb94
  • SHA512 f077b01b26025dc1eae39cddb552b1ecde98a93860fac9d803ca320ed210d8f3fd84609ee1f8e127cf92335b23884643ce02279ee793468806b73f04c5c7ea14
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1/qyx0OFUwdrxIkDPIPzjbxgX3itvxp+395fxoZBDZW:cuR0JTPjY2CqKTNMP3b+XStpQ3WHdUx
  • TLSH
    T115233B003BE9812BF2BE4B78A9F26245867AF6732603D6491CC451DB5713FC68A436FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2