Extracted

• • Target
    be8439acbae5628a815fa793f9e1e752dcf9cb10fbe32f712f96a7d6b79f03d7
  • Size 45KB
  • SHA256 be8439acbae5628a815fa793f9e1e752dcf9cb10fbe32f712f96a7d6b79f03d7
  • MD5 deb46bd8a7fe8d7f61632174173b164a
  • SHA1 6595715871f3f0d52930ed076b49a359938bc98a
  • SHA512 b1c28d47e633672584275a31f304330edeabc7415d4f97931caf6b8f57b2294865ad9af2e0e0c638c1e2b31b8de81d98040462010f3329207087cd6e75b958c6
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qV2pL+Vl78tPIWzjb0gX3isiD+uV0HBDZkx:suJdpTPdI2fU3W3bbXS1quVidkx
  • TLSH
    T136232B003BE8C12BF2BE4F78ADF26145867AF5633603D6492CC451D75613FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2