Extracted

• • Target
    219750286858dace8d9236f93d3502229a118d8aca4de51e4592cdc3d465517e
  • Size 45KB
  • SHA256 219750286858dace8d9236f93d3502229a118d8aca4de51e4592cdc3d465517e
  • MD5 3570e28a858dd76f8b1aafcb4be0886d
  • SHA1 971706e50550e833d7761b5f6a5f566f42060bbf
  • SHA512 dfef123125c8bdfa729ecdc865b4597a23a17984997ed687504695ba3753032a10e63a49e7af87413320ac67ceedb43ffacf95cb0c7cf025a789adb603e21add
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qw8fBohEa+PIvajbLgX3iL8AYb4pSQ+1gBDZMx:ku40ZTXEb2C4EaHv2b0XSL38Q+12dMx
  • TLSH
    T1D1232A003BE8822BF2BE4F789DF26145867EF6732603D5491CC441DB5713BC69A52AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2