Extracted

• • Target
    2e15a0d3453d6737096700651ebb7388b1df662eb52b784dfd81823f94bffcaa
  • Size 45KB
  • SHA256 2e15a0d3453d6737096700651ebb7388b1df662eb52b784dfd81823f94bffcaa
  • MD5 72e3d64d64929616b6a4e730b9610923
  • SHA1 5ea0d1b71ee0c7867608fe572df6296e61e5c7ab
  • SHA512 f30dd903ee83d10b170873d80f191160bb66871cab399651cc2f059a388eb47217616a381aa6c28467d452f18bf6d735a69c6dc1e59e14846cc0adc2cf4675a6
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNi9wScq/z1OPIszjbQFgJ/3iLPIH0MWpSvcRRwO3I:5uSy6pTpoo2fi9K3s3bJRSb8O04Ld0x
  • TLSH
    T1D6232A003BE9812BF2BE5BB8ADF26245467EE2733603D5491CC4519B5713FC28A526EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2