Extracted

• • Target
    7f6d9087527c63d08e7347a8b852b3ce1363d6018b4aaf0d5d1b0757e2dcc464
  • Size 45KB
  • SHA256 7f6d9087527c63d08e7347a8b852b3ce1363d6018b4aaf0d5d1b0757e2dcc464
  • MD5 faf18c5e5fbbc3845bb74cdb7fa36f5c
  • SHA1 0f87153b696b91dc9f1b60f60f2a25dfb77430f9
  • SHA512 a08a2c270e3db86b3129f9273ae0d8fb9cb2d4108124fede8b089ea313055f0db89be6b83ddf5f9fd6884f3f73968a3ce054258eb3723d05f6bde4275aaf0121
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1eI0tnxHuPInzjbEgXjiJ0VJrILtBDZUx:cu6YepTPso2j3r3n3bLX+J0QPdUx
  • TLSH
    T1EE2329003BE8812BF2BF4FB8A9F26145467AF5636603D64D1CC451DB5613FC29A436FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2