Extracted

• • Target
    f900ce4895eb4704fd2d2e892441707cedc4e4b34587be15f6b5dfb3ea2da7cd
  • Size 45KB
  • SHA256 f900ce4895eb4704fd2d2e892441707cedc4e4b34587be15f6b5dfb3ea2da7cd
  • MD5 2b90cb1927ac00fb58cd1af9e9df58d3
  • SHA1 c9bee17815bf7a15e399c9cbddaab70873b89d5e
  • SHA512 591698d8fd7a96c0d3d39af14f0a89adbaedf35a511f29c2a169423491fadfc0bfa630767a4f04ad4da213d47f5d8d3d74fb1e9b3436f2a1d38893bf7184994a
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrdq7c53APIAzjbMgX3UwxRuL+ACvMtUkZaBDZkx:vuogpT7I62+a03lA3bDXE8K+AttUVdkx
  • TLSH
    T1A5233B0037E8812BF2BE4F7899F26145467AF6637603D64D1CC452DB5A23FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2