Extracted

• • Target
    a60e7a64a15d032cb6aa466d4473533e365c89c5412d45e799996ee87ee7f75d
  • Size 45KB
  • SHA256 a60e7a64a15d032cb6aa466d4473533e365c89c5412d45e799996ee87ee7f75d
  • MD5 96cfdcab6c532f1eff49224eb63c3d08
  • SHA1 dd766a2ffd538d6580756b1be16727e3041c30b3
  • SHA512 ae3453620e5e4c9f15e36969554c702b83b9c20cd451807dd09082730bf23a1e05a7dfe1dfc2a3ed73ac1c1c38a03b1969470eee9e01715f10a8e8bc7da705e5
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVA0y3NPAIeiZPI2zjbLga3i+tx1AeEXcjqH/SKNBDw:MuBGJTPho2b3V8iW23b0aSCxKvMeddEx
  • TLSH
    T167232A003BE9812BF2BE4F78A8F26145467AF6772603D5891CC451DB5B13FC68A43AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2