Extracted

• • Target
    491118a78b831a70340a2296b017185cdff71a30997cf91516ac086b2b356066
  • Size 45KB
  • SHA256 491118a78b831a70340a2296b017185cdff71a30997cf91516ac086b2b356066
  • MD5 ec50e7d1becd2a6d16e7441fa77582a5
  • SHA1 8b17ec56ff2e31c84ef737832f9ce8217d3bf4d6
  • SHA512 737067f3e89de8359a7cdf8c68f6a8284c674a3b4f34ce5522b70f7e46587567631d670643bc100a6822e314be0ec7b55552b6423aa8a9211e8b5fdc557ca6f5
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA0wZQBKkPIrzjbugX3i83Ox9bKV7W4xHnBDZcx:UuKWgSJTwRf27br3bRXSgOx9yiGBdcx
  • TLSH
    T1F2232A003BE8823AF2BE4FB858F26145867AF6736603D9496CC452D75723BC5C6426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2