Extracted

• • Target
    89ed2975c8769f62dccfde723e489b7ab28b64416bc323d7dbaeaa9215de7d7d
  • Size 45KB
  • SHA256 89ed2975c8769f62dccfde723e489b7ab28b64416bc323d7dbaeaa9215de7d7d
  • MD5 c008ccda9ed3f985f67970fac559f86d
  • SHA1 c187ef0215db60147fe039c5f0c03f15b3aa4413
  • SHA512 9b779d9b4e02457d2c81c2fa3c3a081fc8b4873914c5305aaa766fad0521944e3666a27dccf5f9cadb44db8e56a8cdb354932c355083b311a5c12acb53aa2cb9
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNy6q0ynzFOPIlzjbmgVi3/BHUPj04KSNBDZ0x:5uSy6pTpoo2P6da3l3b5EvBHkj04dDd2
  • TLSH
    T1F8233B003BE9812BF2BE5F7499F26105867EE2637603D64A1CC452DB5713FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2