Extracted

• • Target
    3cd7bb89518865f53c5f32a4483954d097302f7b220a5ad5813df0123aa4369a
  • Size 45KB
  • SHA256 3cd7bb89518865f53c5f32a4483954d097302f7b220a5ad5813df0123aa4369a
  • MD5 47219abd064591fad186176700846444
  • SHA1 a0f4251f64e256d6b086310cda72dbe252821d89
  • SHA512 e24a9b5d1a1bea777f630cbd1041871436a3a3252437afb6686c2c969339ca590c811233ed50d0d1b96eac0ce71b58e3eff5b46920114ab7c5c3f702d03b70a6
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qF0lrfcBEahPIkjjbsgX3ibLjSuGRBJ8LobBDZEx:MuLAZTnbg2lJkEa+kHbjXSZU0AdEx
  • TLSH
    T10A232C003BE8822BF2BE4F7898F26145467AF6637603D58A1CC451DB5713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2