Extracted

• • Target
    10a4116ff63d3b6b4e5dacd7e7cb9cc9861a9181383eb9d8bb513008e1d7ffd2
  • Size 45KB
  • SHA256 10a4116ff63d3b6b4e5dacd7e7cb9cc9861a9181383eb9d8bb513008e1d7ffd2
  • MD5 7de673f5c1b786a80440edacdf30ebd2
  • SHA1 180148756a583a37dd42de04ce5136724c83f595
  • SHA512 9b66fefbbfbb2f367838bda0798668e559017788d5194b3853ebb8cc34976bff921ffc9d343ee3e772e1fff1c23bfdedda1a051bb5994a26f80188d7bd9ada4b
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1S0e3+KvP8iZPI7zjb5PgO3iZIwXSMzaXx1GBDZUx:cuR0JTPjY2t3TsiW73b+OSmCSMzajIdW
  • TLSH
    T1212319003BE8812BF2BE4F7898F26245467AF6736603D5891C8451DB5713FC68A53AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2