Extracted

• • Target
    846cb18fdbbea140f300583e6aa3efe2552839758ce5e22e15d2d5e6c766530a
  • Size 45KB
  • SHA256 846cb18fdbbea140f300583e6aa3efe2552839758ce5e22e15d2d5e6c766530a
  • MD5 5f4bb9644f0816e517fff8d8b54a5472
  • SHA1 2be013a8c76ecd4dd3f48e88aa8617599b501c68
  • SHA512 ab4cf9ede253f3bffc1533f2db3ad3b034d6373f6c24dd063de199b6e15e85aa7001847279fcf6bdeb57c05bc13ad900adb4b32071fc0d69c5c9826fa77a43c2
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtiCXtTtoPIOzjbwgX3iZgZjZIKAxvYGP7HnBDZ0x:5udApTNmU2Nw3O3b3XSwjZIKAxQm7HBU
  • TLSH
    T1B7232B103BE8822BF2BE5B78A8F26245457AF6773603D58A1CC451DB4623FC58A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2