Extracted

• • Target
    27d6766b4b2f9cb62f8006eacde5a7cde150203f217f1306f83b28c48e56f128
  • Size 45KB
  • SHA256 27d6766b4b2f9cb62f8006eacde5a7cde150203f217f1306f83b28c48e56f128
  • MD5 b2c17beca67220cfeba178c53421af13
  • SHA1 06224657e5712f81ce60cdde9fca5b99ed5c6b98
  • SHA512 6e63e47fe72eddd292f39162869ba0e9ccd8de73911b9d0582491adfd6ba3a3c41e9b6bffb241c1ee12331176587e937050e00691da01e9dee6fe9fb157564d4
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9oORw4iq36NjPIgzjb/gX3n/nAiFPCHuS0SpoBDZsx:EufspTf2g2BORDH6Kg3bIX3/AiFPCH9t
  • TLSH
    T1A6232B003BE9812BF2BE4F7898F26145867AF6633603E5492CC451DB5613FC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2