Extracted

• • Target
    d39182cc9efdd4ab95e893a0fe6638e86ba509145aa97bc9582f2d0439357a0c
  • Size 45KB
  • SHA256 d39182cc9efdd4ab95e893a0fe6638e86ba509145aa97bc9582f2d0439357a0c
  • MD5 490d3e2c10892c8d93c610d1e750bcb5
  • SHA1 23bb8917abcb94607113e19cf88bbcc37b794b83
  • SHA512 a3580f219f90b40c31bb8c305e6f994cb52e0059c0625ef540d5389ac499304f35c2e261ee69d2d0a812581dd12d048f7737d49e013256ee7021accf609e8828
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYZ/rLzlJAOPIc6zjbsgXPiFj/MfVghYVk1wBDZ0x:8uuSpTgyf2hPp23c63bjXq6fMHYd0x
  • TLSH
    T10E232A003BE8812BF2BE4FB8ACF26145467EB6672603D54E1CC451DB5613FC69A42AF9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2