Extracted

• • Target
    3221f76c7b2c1f7ab10ef3f166ff5b9cc07904c6086b2293b0c337b72aae2c16
  • Size 45KB
  • SHA256 3221f76c7b2c1f7ab10ef3f166ff5b9cc07904c6086b2293b0c337b72aae2c16
  • MD5 126e11a364ee0f56aaa916a85d8d3885
  • SHA1 9fb895a52c68229a7548e9605b822b08a8b19ae1
  • SHA512 a15b3fa76068c1cd8551a02f301fab13d9384d7890f068a215443e5ce8c150d2eeb0d42dd5f07032c694361d16903600af7909c312566bbbf29773d0f16d6d75
  • SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7JdR3aI6OPIuzjbBgi3igahZAenlU5FBDZ8x:0ushJTDXgH2ojqb3u3buiSJjnEd8x
  • TLSH
    T107231B003BE8812BF2BE5FB898F26205867EF5673603D54E1CC451DB5713BC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2