Extracted

• • Target
    5a751c12f88eb815bc297011ad3448f3e2f5ec504d13122631792d99941b6dfa
  • Size 45KB
  • SHA256 5a751c12f88eb815bc297011ad3448f3e2f5ec504d13122631792d99941b6dfa
  • MD5 f546b4e434b8d94841485dc3dcb008e3
  • SHA1 20fe4e9f17a1dfc12b9704344b2d472f80d14997
  • SHA512 e977a965bf986e621a0a98022d7c40070e48718b06b4cd2b663806c5034b70423005120b5034139bdf351431c89dab9891cd611ed6ec3328217a25279a8378be
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFdm/9GgrOPIRzjbCgX3iBLLVxfK3lmBDZEx:MuLAZTnbg2um1b3R3blXSNLVxfwlodEx
  • TLSH
    T11E232B003BE8822BF1BE4F78ADF25145457AF2736603D6491CC452DB5A23FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2