Extracted

• • Target
    13d9b184da64754098832f3bfcb6c2b6f49059de1d0dee5de260fafaf4b435cc
  • Size 45KB
  • SHA256 13d9b184da64754098832f3bfcb6c2b6f49059de1d0dee5de260fafaf4b435cc
  • MD5 d3a61b8f0cd4a1e272c2e9a108ca712c
  • SHA1 c2747deaee0b624e60728306eaec38546666268e
  • SHA512 83448bcaa99d7c2b9a79cef3cb110f22b56c1f20b2d91b503ff1d17ab2418c9fbbcbd8b2ca7fb86d1dd4e34a42e096ed467a12fde2867edcc040b363874848c2
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAD/7c83APIEzjbxgX35EuUERoyBM1qoHGABDZcx:UuKWgSJTwRf2zDp3lE3b+XJflDjWdcx
  • TLSH
    T173232B0037E8812BF2BF4FB899F26145467AF2637603D64E1CC4519B5723FC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2