Extracted

• • Target
    d99757e751adbddd29c08a45b5515a787bf60e25d3187426e36d98bb6a2d32c8
  • Size 45KB
  • SHA256 d99757e751adbddd29c08a45b5515a787bf60e25d3187426e36d98bb6a2d32c8
  • MD5 5c8eeb2269b1029cd742a697b61518a7
  • SHA1 97447d0999bffb0201ad183453bf5a5baf73362c
  • SHA512 d9e59a978a632ebd5f21b78a30038fdf90c51ce6be004cbf395b921d4bb27517dada15661a9965283d197175cba6f547483d6ba9b87fc2077771b0d7f7ccb673
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFOeeXK5o5TN8/nPI6EzjbFgX3i5RR99qPdEBDZEx:MuLAZTnbg2aeEoTNKA6E3bCXS53PqP0E
  • TLSH
    T1CC232B003BE8C12BF2BE4FB8A8F26145867AF6733603D54A1CC4519B5713BC68A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2