Extracted

• • Target
    c0c30fba3f78f8965cf75434199920d40bcc70871e4dfcdcd3bea229ad3b6fa5
  • Size 45KB
  • SHA256 c0c30fba3f78f8965cf75434199920d40bcc70871e4dfcdcd3bea229ad3b6fa5
  • MD5 c67bf82477e3ead2e312c0d5f6f36be2
  • SHA1 b7f22ab536e0e2b6df498f8bdb77b185647a33c9
  • SHA512 f539694b69d545bc4efed907558c50fc5bf2202db380823a467dee0230862b9d7f6be1ec96b511618f2f3cc39b8de1296542130ff6982f145d65b661f7fff4b2
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qY2W8PIXOPImzjbdgm3ivSXIe2SMC2My4BDZ0x:8uuSpTgyf21Iu3m3bKmSvSXIHSy+d0x
  • TLSH
    T117233C003BE8812BF2BE4F78ACF26145857AF6673603E54E1CC451DB5613FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2