Extracted

• • Target
    80211951fbdf3d2df74a1bc0bb118348a0ed4ffee2f95ea99d0504ca9992367b
  • Size 45KB
  • SHA256 80211951fbdf3d2df74a1bc0bb118348a0ed4ffee2f95ea99d0504ca9992367b
  • MD5 8dad8c6cdea2ad25429267f94e9d6aa0
  • SHA1 cde592aab9afeb300bb113021d43b4eec0ffcb11
  • SHA512 8303507460a2f202cac9ec7c8e27bfb610f37976e87f48135fdfdb84cea3860576eba1435f126b481608185ce6bf64c8f780e1a86823cbc6a77f300737103dc6
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwg3xY6AZOOPILzjbIgr3idf+NqVJh5sOBDZMx:ku40ZTXEb2culO3L3bfrSd28hyAdMx
  • TLSH
    T1C1232B003BE8812BF2BE8F78ADF26145467AE6B36603D54A1CC451DB4713FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2