Extracted

• • Target
    87acd09b623c91de2959661dfef40714b2638a4cbf7469b7f7143e2d875f0168
  • Size 45KB
  • SHA256 87acd09b623c91de2959661dfef40714b2638a4cbf7469b7f7143e2d875f0168
  • MD5 c8fa7014d1eed704395912d23209fe7b
  • SHA1 129df544a6e202c0c22efc4755f2225d14931300
  • SHA512 6c6f5f2d4eb00ed6a3a09d3d04f2e124ef026966a2515548577e0998f4ffdf8af27892b6a1177fff33d11f15ae02c3ae742a414923d62ea3b02c55fc25fc516f
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98zjHy/aKPIbKjbjgX3iyaSlrTjyI3lV1BDZsx:EufspTf2g23nhbGb8XSyJ/1bdsx
  • TLSH
    T19D232A003BE9C12BF2BE5B789DF26145467AF6633A03D64D1CC4119B5613FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2