Extracted

• • Target
    88dad27ef0be874570a3ef26e63eb59e12fc2866e89925a03581e36eb7f48b65
  • Size 45KB
  • SHA256 88dad27ef0be874570a3ef26e63eb59e12fc2866e89925a03581e36eb7f48b65
  • MD5 4b05554559b301b16bc378d5451977f1
  • SHA1 2890589c73945bc54e6d7b8ccda1be136fecc6c5
  • SHA512 670a7f17ab5d92c15340f99c55d627039688177adf10f08d5a83fc43c26041e3978dea33a3f965b5b4f8e3659f4fb11cb17fa9ef79cc0874891bb0cde6fd6b7a
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVtBz3QKx7PIU5jb4gX3i9agHI8MTb9yfBDZkx:suJdpTPdI2IV0U5bvXS9FoHTIpdkx
  • TLSH
    T14A232A003BE8C23BF2BE4F78A9F26145467AF6637603D5892CC4519B5613FC6CA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2