Extracted

• • Target
    1d5e58d0ed36982ce650a05b6db2af36bcf59db6b261ca9007b42a652dbd17f9
  • Size 45KB
  • SHA256 1d5e58d0ed36982ce650a05b6db2af36bcf59db6b261ca9007b42a652dbd17f9
  • MD5 4d06e478aeb44e188e4d9f5288d2581c
  • SHA1 0d2a9f5005777d0d252c03a84cd6104e7fd5a440
  • SHA512 1d2d961ceb5d6a7d9d506d7d5dadbdf683c6ebdb177056b87fbc87d07a2b787ceaae65e43423b4ca50529c02c01ce57504ebbc35fb4c5fb79abb3e8ba2ea3f24
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q12FpPklON8APIDzjbogX3iL6w4/aUebBDZUx:cu6YepTPso2f7kwN8lD3b/XSV4AdUx
  • TLSH
    T193232B003BE9812BF2BE4F7899F26145867AF2637603D64E1CC451DB4723FC68A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2