Extracted

• • Target
    eff944647157061127a23569d91034f26f06ecb4b58435ab1f07ff88b4c3b3e9
  • Size 45KB
  • SHA256 eff944647157061127a23569d91034f26f06ecb4b58435ab1f07ff88b4c3b3e9
  • MD5 cb5f711ff6026afdf1b4095a25c0f3dd
  • SHA1 5c95fd3b8179b649ae2aa07acd779714f7929730
  • SHA512 ac964fd63b95c3a05b0b918cdef2914b52367e1f18cca76848d1f0182acc394060a44b9553a567d217266efa9dbf500076e684396642c5ab1a37dfc07faf948b
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9FDEU66ZjlOPICBzjbUgX3iAw0isQW6iWbxJBDZ8x:0u1YJTHcw2aCsh3CB3b7XSDsQL9d8x
  • TLSH
    T176232B0037E8C12BF2BE5F78A8F26145867AF6633603D5491CC451DB5623FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2