Extracted

• • Target
    410b27fd2239667c93da898ea6d62630c7c4c3fe5e26bf0cb7cb01454627f176
  • Size 45KB
  • SHA256 410b27fd2239667c93da898ea6d62630c7c4c3fe5e26bf0cb7cb01454627f176
  • MD5 24fec7c5cf14979cc15fe9564e79520c
  • SHA1 a7b8520229b45ad08155bbcd6e2a06a400c5bac2
  • SHA512 43013ef026a90abe2ca0d873b734193406af37ff7bf4100147db6bfcc48d63baa7890fdafa2f0420ac973a160ba573d719304e9ee8c59e6218596ce6a526ca6a
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYlCSwTMSPI5cjbNgX3iJ0aWB4+lWxJBDZ0x:8uuSpTgyf2dgG5sbaXS2z4+WXd0x
  • TLSH
    T166232B0037E8C12BF2BE4F7899F26245867AF6673A03D54D1CC4419B5623FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2