Extracted

• • Target
    05233629e6fde8e347f51018d617002df036ef89e238bcdb78ac2a0be3381333
  • Size 45KB
  • SHA256 05233629e6fde8e347f51018d617002df036ef89e238bcdb78ac2a0be3381333
  • MD5 182947c2c4cbdb241530749118447605
  • SHA1 986e2f9c484d2a9c789e11e4574ddd71c78435f1
  • SHA512 8ca53b312318b7c04e73e32b94ccb422b4294ada32e223d0efcd1a867db223f947262aafc5ebf549deaebf504cc490dca3fa67d0d7e6a0078f85f2fb7f85847d
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4Mwz/y3qiPIKzjbzgX3iYGI3+sWC+NaGrBDZ0x:8uUIpT4vAj240hK3bsXSYGI3+sWC+AGi
  • TLSH
    T1F2232B0037E9C127F2BE4F7899F261468A7AF6633603D58E1CC4119B5623BC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2