Extracted

• • Target
    d17fd6629af4c889ceae10c08425f0f3d368bde09aa8c9f78b034590c8256006
  • Size 45KB
  • SHA256 d17fd6629af4c889ceae10c08425f0f3d368bde09aa8c9f78b034590c8256006
  • MD5 3420c53ea4e0c6718de3fbf7f580e5a4
  • SHA1 09f51be9cc5b917b26bb2d4479d48f32010850e2
  • SHA512 e56f69bb8b3ae83031e2c962a4863257a7eccb31d03538c524262ad5db37912fd38a5c40dc61377fadca6951fd3543a2a89aef80a7bab1acf6cdee0053e4247b
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVpgzIUVx7PIdfjbCgX3iOl+Jy77/owSAM4BDZkx:suJdpTPdI2057drblXSOl+s77wX+dkx
  • TLSH
    T1B6232B003BE98227F2BE4F7898F26145867AF6637603D54D2CC451DB5723FC68A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2