Extracted

• • Target
    94ee95f911fb5fe7f29a061c58804334bdaafb1ba82ae3c524e1b362442c3171
  • Size 45KB
  • SHA256 94ee95f911fb5fe7f29a061c58804334bdaafb1ba82ae3c524e1b362442c3171
  • MD5 c277c264b40b57d486986e5289144b6b
  • SHA1 36d5ce52cd577bc5a4e2a6b7ed644631a9c841d5
  • SHA512 d165bdad5290dc93e3ac8ec92d53a0c48b78d14d36ad5df457ebffdac0c9944e00f1e3da3f63c402f7c118ff3259fbcba9c44ff813666cd39de64fdd79527dea
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFvZTohEaSPImzjb9gX3iIMR0c/6BDZEx:MuLAZTnbg2O4Ea7m3bqXSjR0ccdEx
  • TLSH
    T1D3231A003BE8812BF1BE4FB899F26145867EF2A36603D54E2CC411D75713BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2