Extracted

• • Target
    ad04bfa4bfb5036874a4a242eb789878d2ba122ddb338bf2efa076ff432f6ee4
  • Size 45KB
  • SHA256 ad04bfa4bfb5036874a4a242eb789878d2ba122ddb338bf2efa076ff432f6ee4
  • MD5 317de5af5e613fd32d63fc22886e4a8c
  • SHA1 97816fa253aeee9d11cca9279b7fd800efe649f7
  • SHA512 f66e269aa967ea80b38dbd1404a03b3dd2fe993469cbc5b5f0977075be435b1a071c5f1b0a3f08920448176d51483296b5b6dc1ed5733f4431cd3e09dfa571e9
  • SSDEEP 768:wuSOpTPTCFcWUeXa6mo2qAUsD/pneqPIkzjb0gX3iaQOkGEVn59KVBDZAx:wuSOpTPOP2ksjJeTk3bbXSaQ+EF59Ody
  • TLSH
    T1DF232B0037E8822BF2BE4FB899F26145467AF5736603D5492CC451DB5713FC68A826FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2