Extracted

• • Target
    b25ac295e2dcc2e468cc03b29452137b6a4edff9bb39b797876c7c9e9938cdbf
  • Size 45KB
  • SHA256 b25ac295e2dcc2e468cc03b29452137b6a4edff9bb39b797876c7c9e9938cdbf
  • MD5 de8a266e94f46fc1a6fafbfbae62689c
  • SHA1 e19dd9a933c10e5c9bf880356bb9d4043ac13ff1
  • SHA512 b16a1cbb5be3a3d897fe57de7351ce379f2f2efed5b952a45816c28dd31521fa6dad3583f0d8b8ebc0e6ada22630b4899829dbf186fabe99b54b31a9c5db949f
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAaLiE0yFjrdj3kk8PIhxjbMgX3iQ+KlqWW8IAAKqXFL:kuSOpTPOP2KLBXDBhhbDXSWqp8IAO1JN
  • TLSH
    T149231A003BE9812BF1BE4F7869F26145867AF6732603D54E1CC451DB5B23FC68A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2