Extracted

• • Target
    a834d0bd77107779732ad8b1a57e60aa3bb135b86289430bdd8de7fd38244131
  • Size 45KB
  • SHA256 a834d0bd77107779732ad8b1a57e60aa3bb135b86289430bdd8de7fd38244131
  • MD5 fb3554126a29448172d638021b102479
  • SHA1 49017e97822a4565a58d926daa28aa6eeb85a309
  • SHA512 d6c966d5d25466a280b4bea413302c4bccc7ebd5b0680801dac00a39b360c1ed6e730caab35b8604023d0dc055c9364dbef3e0e6fa64c904df11d436f8c421bf
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qw6l9xcPEaPPIU7jbEgX3iL4zeDGohawHVjBDZMx:ku40ZTXEb2+1aEaIUvbLXSsqisaQdMx
  • TLSH
    T19F232A003BE8C12BF2BE4F78ACF26145867AF6732603D5491CC451DB5613BC69A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2