Extracted

• • Target
    2191b024673b3765c844812043095dc427dc6413480d5090f0bf52e7589db95e
  • Size 45KB
  • SHA256 2191b024673b3765c844812043095dc427dc6413480d5090f0bf52e7589db95e
  • MD5 ff0d46c1923729200ffb920a8164fa87
  • SHA1 9c80fc1edf51cef907bda0493c18ba7a72e4bdf3
  • SHA512 c711563fdd3b1768879828eba4b89f1d10dfcc9a344ed7fe8ec4529427def2c6aa7cccf38838600ce1741a20ef5880ebdd52849c5441f0b431580b43fb077918
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlLlsHoPEaMPIG8jb9gX3iq23vbUfebExCA8Dwyiu:wuDWZTpMZSB2OuuEaxGMbqXSfzUfrx5o
  • TLSH
    T148231A003BE9822BF2BE4F7899F26145467AF1632603D54E2CC452DB5713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2