Extracted

• • Target
    245c996e485bad5af5d5e9bf9b045fea94f730175b99ad5fa7d57648de7ce49d
  • Size 45KB
  • SHA256 245c996e485bad5af5d5e9bf9b045fea94f730175b99ad5fa7d57648de7ce49d
  • MD5 3c8aed2b5362c57070d2c3970bd2eb51
  • SHA1 a926ffca0675cf108733a16b21b4a300305c2954
  • SHA512 d3ca600742cd2bc5dd1287cb741966beff4b6754c625caa4bd6fa0e6e8f73738d40b4b42b2d98ca72ad7fb060a73ece36d14b89581942577b1675812da52a861
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qA1cP0pycvHPIjzjbAgX3i+bVVLqTBDZMx:kuSOpTPOP2FccMcvgj3bnXS+rLq1dMx
  • TLSH
    T1B9232A0037E8C23BF2BE5F7898F26145467AF6637603D5492CC451DB5623BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2