Extracted

• • Target
    13d0b88de4cb7a081b4d89eb235d5dfd3651d476c8420437d0699a3d5edd6f5f
  • Size 45KB
  • SHA256 13d0b88de4cb7a081b4d89eb235d5dfd3651d476c8420437d0699a3d5edd6f5f
  • MD5 0d7285171a467e34f667f67f250fa22f
  • SHA1 900d120d2560dd5364040319dff2fb287a4592ec
  • SHA512 457967262b5ddb1d54a190b733f85a6679fcdd82e21660c0e5f32592f0678928ac643c6b3e3035dabc74b4db724701de13b20566d28e4bc5f8c00033717337c1
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98wD/y/aqPIEzjbvgX3ivNI7hEG2toXQSsDsBDZsx:EufspTf2g23khE3bYXSvNI7hGtK8Wdsx
  • TLSH
    T1FD232A003BF9C12BF2BE5F7899F26145467AB6633A03D6891CC411DB5613FC58A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2