Extracted

• • Target
    968b8d8dd7e5fec415835ea54f3f3d2c63007a9a084bc00fb451cf638d2b27b3
  • Size 45KB
  • SHA256 968b8d8dd7e5fec415835ea54f3f3d2c63007a9a084bc00fb451cf638d2b27b3
  • MD5 4ac5b2b226d48a1e294063c8a5b8f3c6
  • SHA1 4ab17a7d2b72ab1b671a02be25e279c0fa01d9fc
  • SHA512 b44c99050a2dcd20e688e1d36b758d74bc21bb528672841c570a0e74690c35ec5e0d784c751f3dd5572d78bad53b7da8d07286ef487ea0799e480f354e1d628b
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAjT2QAm7PI1PjbagX3islAmYQv6Kc8XBDZcx:UuKWgSJTwRf2GT17bNXSsllYcZdcx
  • TLSH
    T158231A003BE8C13BF1BE4BB8ACF25145867AF6636603D54E6CC451D75623FC68A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2