Extracted

• • Target
    471b2dd0a742ccd9c0a2bf057c13830011b48bed960b3e4dcbe8cf0f7798664f
  • Size 45KB
  • SHA256 471b2dd0a742ccd9c0a2bf057c13830011b48bed960b3e4dcbe8cf0f7798664f
  • MD5 2cdeab11a01c90742b01dd65125d6f89
  • SHA1 7b8e40659ef16156ab012fa123ac33b541eaeed8
  • SHA512 42e4fc1bd78a5511dae985326705dea9c3944bfc8e7ff46016a348d94f7c0af47b26725bda5cd2967e138a99d71fa1b88c8d8e5f9b7aaad2476cd90983f6f91c
  • SSDEEP 768:wuSOpTPTCFcWUeXa6mo2qAUsD/pneqPIkzjbxBgX3iF9p67pqPOhTWn0BDZAx:wuSOpTPOP2ksjJeTk3bsXSFKwPOhiCdy
  • TLSH
    T1FA232A003BE9863BF2BE4F7858F26146857AF2633603D58A1CC441DB5613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2