Extracted

• • Target
    5fce59ccf7dfeabbf6ebe46311169d5c39992adba8e14bb1529da430a41f17ea
  • Size 45KB
  • SHA256 5fce59ccf7dfeabbf6ebe46311169d5c39992adba8e14bb1529da430a41f17ea
  • MD5 8cdfa5baafab108e3e605168fd49a9de
  • SHA1 e4da3478722efe4786aa843d95c771b5f6f063e8
  • SHA512 627dd0de166817756ab3f5135f0bda83f07b878ca0ec5ea4c80eb14bddec8614560960f18c6e2d22e726e91488c233b12df5045e63c1619b167841dc030e2a5f
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1n+GtnVnJtHuPIWzjbqgX3i012sZFEeHdMWXdbZr:cu6YepTPso2M++B3W3b9XS01dFEu6Y73
  • TLSH
    T1A0232A0037E8822BF2BE4FB898F26145867AF6633603D54D1CC451DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2