Extracted

• • Target
    19869e66ec2165312879daee58220cf9e12c9bf4e29fbb7aebd83bd086e15283
  • Size 45KB
  • SHA256 19869e66ec2165312879daee58220cf9e12c9bf4e29fbb7aebd83bd086e15283
  • MD5 5b192bb50dadfdb0d0b6fade8972a7b2
  • SHA1 9751e8a238fec0b1574243fb83bcdf412a0a71c1
  • SHA512 a564c9d7bccc2e00714ea602f6130abc5b63b1249ac897eb0fe1c113401246f37aabcb1a88d3b3ad92f0337b2f9b37cf9ee073e21415b6766bf239d6180ecbb8
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAFxGQGPPHuPIxzjbjgaL3i4pUhbPNPKyBrBDZcx:UuKWgSJTwRf21Hw3x3b8aLS4pcC89dcx
  • TLSH
    T1C6231B003BE9812BF2BE4FB898F26145467AF6733603D54D1CC451DB5623FC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2