Extracted

• • Target
    24f812332fe3b8b583e7af819ffa941eaea2c67e8a8d08b672321ca5374e0d00
  • Size 45KB
  • SHA256 24f812332fe3b8b583e7af819ffa941eaea2c67e8a8d08b672321ca5374e0d00
  • MD5 e44d1eb3caece2c02d2719e79ca5a058
  • SHA1 97542ed5f7910119b78d61144c5ede2ddfca79db
  • SHA512 1e183056d2938634ac90ddb66f2f033034413fbb02916e6915351dd6e26f5776a5d11bd57251df7811e54f301c04bcc2b14cbcfd732d1946f3c04c8b39f69ad7
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4wQzPivMPIFSjbngX3iaqse74pASuBDZ0x:8uUIpT4vAj2RzMF+bgXSNGOd0x
  • TLSH
    T137232B003BE8C12BF2BE4F789DF26145867AF6672A03D68D1CC4119B5713BC58A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2