Extracted

• • Target
    d3578a5c1220c8344af6d11e77e6cd392063e9820ac36c0ea14aea1c6d6de57a
  • Size 45KB
  • SHA256 d3578a5c1220c8344af6d11e77e6cd392063e9820ac36c0ea14aea1c6d6de57a
  • MD5 affe479716867140000e6d23f7afa4ac
  • SHA1 6ccd68dfee00b68d60b5603489b83448849b23fa
  • SHA512 fc3e37d21dbf694597d1b948e36636c8b2e6032f93dcd17b1e9b8b94745044675755580d6f4c3ad9ae76e805bb6d7bbcb05f9db7edfdd2a61faaeaebd7e96980
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAaLiE0yFjrdj3kk8PIhxjbYgX3iS2iqZ5UPmZaBDZMx:kuSOpTPOP2KLBXDBhhbPXSIq3jZEdMx
  • TLSH
    T1C9233B003BE9813BF1BE4F7859F26245867AF2736603D58A1CC441DB5723FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2