Extracted

• • Target
    9bf2fdad4a4a43a9ed9bccae300e22603ced2ef96569854e288f0dc25a2fe701
  • Size 45KB
  • SHA256 9bf2fdad4a4a43a9ed9bccae300e22603ced2ef96569854e288f0dc25a2fe701
  • MD5 300255c94846db2eea041eb38cbef87a
  • SHA1 bc9495ecf87c18210be505074bb05b2497f514fb
  • SHA512 995e39a67b78a9f6f00bc0d9fb5b70973d091326585f7d978c466c5f1c0d8f27303bfd2d675d38a39c78baf8f666e5404d000e4d5b030ebc2b6ac440e07f8149
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9zCOtTMtPIazjbggX3i+u1jyNkcLxcopxyUahsBDZsx:EulCJTHl42MRva3bHXS+7LxfpxChqdsx
  • TLSH
    T180232B0037E8822BF2BE5F7898F26145867AF2772603D58E1CC451DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2