Extracted

• • Target
    23bd2a91615f77c5bd416b8fcee561ad492b3b106da99685b7001dd4030daeeb
  • Size 45KB
  • SHA256 23bd2a91615f77c5bd416b8fcee561ad492b3b106da99685b7001dd4030daeeb
  • MD5 f41c003e71e6cda020f7409ab559f778
  • SHA1 34427d436474d2c8ddb796ce2b36c82b8b1af7a5
  • SHA512 d87cb48615ce3264bb29fcf8cdf42b4ba30d3d1792cf13fe427ed1ee540f024eac1c84268ebb5d4d79ddc6b02511186ac66322789821fcd4b34f4589c693762a
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrO/yc/3APInzjbGgX3m+7CXlt0BDZkx:vuogpT7I629qC3ln3bZX2+7CXlkdkx
  • TLSH
    T168232A003BE8812BF2BE4B789DF26145867AF5637603D68D1CC451DB5A13FC29A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2