Extracted

• • Target
    62226da4b4b46a1e1f85e4292852bb6129afd3d3cb689c6a60921524981c1b20
  • Size 45KB
  • SHA256 62226da4b4b46a1e1f85e4292852bb6129afd3d3cb689c6a60921524981c1b20
  • MD5 e73d8f1b0f0dbf9ee0a179d0a6ffd0d6
  • SHA1 7e6dcbaefb37cc145b917f7687c7c6117c63a064
  • SHA512 b4f275637af4727aba6fc5bc4baf8560b4ede9cb153c9b4afcde574790c79aa305031aeb41dba47d8200a738438cc7b6491eedc86e1d1086a9a2e729d1dab6f7
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF7SAFcKoabbb4ZhM/RPIAEzjbPgX3i5hXoFcIlOWb0:cu7e5TH2A2QSAvQZh6OAE3b4XS7XojUD
  • TLSH
    T162231A003BE8812BF2BF4B785DF261458A7AF2632603D54A1CC452DB5723FC69A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2