Extracted

• • Target
    eddd4af0d92caaaa69b8909b18de3b5cb0f4a5a73601325ec9c12f85530bae8b
  • Size 45KB
  • SHA256 eddd4af0d92caaaa69b8909b18de3b5cb0f4a5a73601325ec9c12f85530bae8b
  • MD5 44daef3634b53eb9348b36c88fc67173
  • SHA1 1df371ff26fb9c0f5cb0ca8152f2b0506e41678d
  • SHA512 767d19a08fb54f80740bfd6da0b02a74287279606eecda3dbf4f5d20bfcfad8f38abe5dc6a4c4e0c13651c38618262f9f17bcccc49fea44edce6aa5c504c1ddd
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVj0b3NLAteiZPImzjbRgu3iyuZ4gF1p0sTldkqBDZG:MuBGJTPho2/3ZhiWm3beuSyEF17TlrdG
  • TLSH
    T118231A003BE9C12BF2BE4F7898F26145867AF6676603D5491CC451DB4623FC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2