Extracted

• • Target
    7d3dec60f0c4f060a0d2b4ecf0664a65ddee4d17563cfdb478b8777709759d52
  • Size 45KB
  • SHA256 7d3dec60f0c4f060a0d2b4ecf0664a65ddee4d17563cfdb478b8777709759d52
  • MD5 682a148e85ab0740e49a36c181762abc
  • SHA1 5bf0e60d1ee33777560d42f21b873007ed577e7d
  • SHA512 bb2211df92dda10fb5a579fb8961897ddb9e58d25c4d9dfda793d0b4419532470d6a9afcf9d5a46f879fc6c6bedc3fc0a4c9c18963205953ab4018de4306882f
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFG9xY6aZOOPIrzjbGgx3iL+Coa9LiwLQ4ejnBDZEx:MuLAZTnbg2Ds/O3r3bZxSL+CnLtQ44dG
  • TLSH
    T136231B003BE8812BF1BE4FB8ADF26145467AF6736603D64E1CC4519B5B13BC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2