Extracted

• • Target
    ff00996745178403721a703081e23f6ecac9c8c9cfc0ce6297b57c05020a50d8
  • Size 45KB
  • SHA256 ff00996745178403721a703081e23f6ecac9c8c9cfc0ce6297b57c05020a50d8
  • MD5 80a078e5645a31e33428b24beb609103
  • SHA1 7742754bdffbd40a3d10e471e559e6f8ae14804b
  • SHA512 b929a1189177121e1153716f03be259d6027cb846c00f756ad1732ebe128ca4c6083aa460ab579c4aee150ff14c184eb3186c6024c3f24fd022863695125a746
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4GoopCBK9INJPIZzjb0gX3iy7TIMrReOvCO7BDZ0x:8uUIpT4vAj26o6bIwZ3bbXSynxrYUtd2
  • TLSH
    T129233B003BE9C13BF2BE5F7899F26145467AF2632603E54A1CC451DB5623FC68642AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2