Extracted

• • Target
    141f972e3f0e7fe01e98001b04d5978602e23fa3778ffe6cfea9cb55f5fdda73
  • Size 45KB
  • SHA256 141f972e3f0e7fe01e98001b04d5978602e23fa3778ffe6cfea9cb55f5fdda73
  • MD5 2a8c0eada377b7cac50f99d4201b47c9
  • SHA1 1812a2229a4b64e3b2eb4424d6e0da2b19c83d47
  • SHA512 bfbc155596385b2aff50cb987d7d0911cb780c7cd43ade3207d72277379bf0b6ded0483eff57229c7e5a1d86d07b6f5bf13fa73dcf00bcf07344ec125c466bd8
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwvBlte40WMOPI0IzjbdgXeiEoP8eX5doeVMoGKBDZO:ku40ZTXEb2F2UM30I3bKXnEspWuMoGU8
  • TLSH
    T1C5232A003BE8812BF2BE8FB8ADF26145467AF2737603D64A1CC4519B4713BC696526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2