Extracted

• • Target
    993d18bb2277e543c5ae435d5669d7d15eaef8413eaaeaf71a0420e887c28446
  • Size 45KB
  • SHA256 993d18bb2277e543c5ae435d5669d7d15eaef8413eaaeaf71a0420e887c28446
  • MD5 f0be03fd6c94b74d11b01d01447693a0
  • SHA1 af8b29cb9b1ea681e1dabae7bf845018a39070d1
  • SHA512 1242c742883eef1c6366866037cdb193697ac6ec0e17ec283584221eb802d952119cb18b69a305aa7c80645364ad282683bcfd726388515a388cffd51b4ed90a
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFH/l3u40cMOPI0azjbsgXnitSEyFBmMBsZhGBDZEx:MuLAZTnbg22k+M30a3bjXi0Ee8MBsZhT
  • TLSH
    T1F2231A003BE8812BF2BE4F7899F26145467AF6637603DA4D1CC451DB4A13BC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2