Extracted

• • Target
    9558e150bbc2201df2431734586069574fc425bac39cc8624df8892d06e08ce2
  • Size 45KB
  • SHA256 9558e150bbc2201df2431734586069574fc425bac39cc8624df8892d06e08ce2
  • MD5 20a8113f7facc9cf733fc9af8e02d0d2
  • SHA1 e8387fc8bf3982460c946ecb8d04ff878fc39804
  • SHA512 9fa4ed358c5890024b6b72ef166755cd720cec6713f6a0f48bb0ef799069a88bb9f57d26b7bf6fc8d6d96a1b3939609525c6662d0dfae55a3dcf747a5d66e03f
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYhdR3aI6OPIuzjbhgO3ipgvMrplGYEqMi6YrlmBDZ0x:8uuSpTgyf2Jjqb3u3bOOSqup3Mi6YGd2
  • TLSH
    T108233B003BE8812BF2BE4F7898F25145867AF5673A03D58E1CC452DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2