Extracted

• • Target
    c27cc740a3792434b855df60b11978b2cbdd69099d389d93995acd8875cd4e03
  • Size 45KB
  • SHA256 c27cc740a3792434b855df60b11978b2cbdd69099d389d93995acd8875cd4e03
  • MD5 3e89cbbc2aa0a2f427ad89057c186ffb
  • SHA1 d17ec87de38d562c578210746ddf352032aeb58f
  • SHA512 506fa04247fd9072cd41d572cd27f4a158d5e6b886237cea3af45b80abe93f7f341ef53254d4b65fcdfdc44d81a5433522fa0c7aae138090ff25abb00484311f
  • SSDEEP 768:QuflpT8AkKuWUch7wmo2q969YSkqXzNOPISzjbggX3iBMIKpymUCaih0g9pBDZTx:QuflpT8Hv2HaVq3S3bHXSdyyDC3h0+dN
  • TLSH
    T15A233A103BE8C12BF2BE5F7898F26145467AF2633603D64A1CC4529B5713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2