Extracted

• • Target
    1ef6cc03af60f865f77ddac1c1573fdf9c097f817cf8486b9bb58bfd8264657e
  • Size 45KB
  • SHA256 1ef6cc03af60f865f77ddac1c1573fdf9c097f817cf8486b9bb58bfd8264657e
  • MD5 4a8b99cffa5d708d1daa048714f0dd72
  • SHA1 f5cc9135d782299aa84ee516cbf1cf64de6ec1f4
  • SHA512 8ecbe71354085adb4b8f751a6f686c10cd766e1abf4ab0cb8a92a1c39f1751e5911fc9106aca70f2cdb4eefaa8b6c745a9194d1cceb3c7c5cfce59749902c22d
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYlCSwTMSPI5djbcgX3irN/XnwVoHXB4BDZ0x:8uuSpTgyf2dgG51bzXSpXwVoR+d0x
  • TLSH
    T1A3230B003BE8C12BF2BE4F7899F26145867AF6673603D58D1CC4419B5623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2