Extracted

• • Target
    90736c4ab4ed4110ade415277466bbd2b14643cc1b1c9a9a066e4307c694cfef
  • Size 45KB
  • SHA256 90736c4ab4ed4110ade415277466bbd2b14643cc1b1c9a9a066e4307c694cfef
  • MD5 84716ae70bc33bf84237818a3449f302
  • SHA1 910a98a89ee8c8bf2a100893a8bd6a3bbaa15d4a
  • SHA512 f44f439cf6681caed8e1a66f1d4e4f77446ff7bcadad34019e1a8409a92873f92c8e23c5f69a77aa0dd84c185931b5e079b03e6086f0a9c81c49efe8c9e03d89
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVv8V1NpxkcPIyzjbIgX3i4Ejnj4BDZEx:MuBGJTPho2s8VXvkhy3bfXS4EjydEx
  • TLSH
    T109232B003BE9812BF2BE4F7899F26145867AF6632603D64E1CC451DB5723FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2