Extracted

• • Target
    4f02bd16beb8ce92278417317f4a39e474883ca3ea2afda73cf87fbae31ee42c
  • Size 45KB
  • SHA256 4f02bd16beb8ce92278417317f4a39e474883ca3ea2afda73cf87fbae31ee42c
  • MD5 0c97d70933d097d979dbe5e900f57ee4
  • SHA1 3c40d27d946306c5c759fafaea8699a07db28f7f
  • SHA512 bdff8a91773f59aea41f2098a8ab9ee4c2f670c4d2fe9710f364bbd45ac2c6201e5633550a334f2593b3c600d83ebee122f3cc3873f8cec3afe86136efaadc4c
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9oEYSCBTPKNjPIZzjbRgX3i443vUfDSkosBDZsx:EufspTf2g2hEl8KKZ3beXSdvSDS4dsx
  • TLSH
    T183231B003BE8812AF2BE4F7899F26145467AF6637603D9492CC451DB5613FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2