Extracted

• • Target
    50b114778b1618a376a3129c2c3f59b76218115ef64565b7dcd5be323c837125
  • Size 45KB
  • SHA256 50b114778b1618a376a3129c2c3f59b76218115ef64565b7dcd5be323c837125
  • MD5 d288be929fc333f118f4bf05d91230ef
  • SHA1 17db73afe536bcfae011bf375a77c57e92cdf9f5
  • SHA512 d176282930a8811da13014e53e53c425f9a6d8b9a789a799503a7241c0dadf3ba894b9359db92145e17a37138134dad333a64be92811800403235d78d0fdde97
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYDrE7HLCj9OPIIAzjbTgX3pO4OXQXremvOjcAmEdTcW:8uuSpTgyf2bSWR3IA3bMX5O/Yr3mA/Ep
  • TLSH
    T162230A003BE8C13BF27E4F7899F26145867AF6633603E54A1CC451DB5613BC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2