Extracted

• • Target
    396612e9417bd02920aba1fb9cdfd56d0409878feeb466453a01e9176555fa87
  • Size 45KB
  • SHA256 396612e9417bd02920aba1fb9cdfd56d0409878feeb466453a01e9176555fa87
  • MD5 cdb71aafdd46724cc4eefb2b3029f04c
  • SHA1 0a3ded65cb94ece635bb0b58e774101f2ebad09a
  • SHA512 52d3cc247766782b06113e0c61c16585355bbc66e3e48f0335e4844882a8ecd99ac51fc57a0c02c0ba9e8a8a133ed0a8b3ed86eb23da4273562d8edf7428b183
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q18Q0D3+/vPPjZPI7zjbwgH3i6Y2rnoL5BDZUx:cuR0JTPjY2DP32/jW73b3HSD6oLndUx
  • TLSH
    T195232B0037E9812BF2BE4F7868F26145867AF6633503D6491CC452DB5613FC69A43AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2