Extracted

• • Target
    18f811bf67d52642cc3f4d81f879c2adb2f80513fb30ffd37b714906869539a6
  • Size 45KB
  • SHA256 18f811bf67d52642cc3f4d81f879c2adb2f80513fb30ffd37b714906869539a6
  • MD5 21ba5191c06287ea91205af66eedc412
  • SHA1 c5223c2fbaa0eac361252c9d709882c0a2f8320b
  • SHA512 5074c7de2ae9a3d04629bd138083d40ec4dc75fda56292c57182df6dd55d8f539725487f3788d9288d8eb4ad94158c57a807d561529ae48c6b0014bca1d208fd
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9oozHyvCKPIi8jbRgX3iERRMxk+DnlDkjzbBDZsx:EufspTf2g20L5iMbeXSqMk+jlD8dsx
  • TLSH
    T10D232B003BE9C12BF2BE5F7899F26145467AF5633603D6891CC4129B5713BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2