Extracted

• • Target
    80fe040193ec7f8ca66789dfff9b4ddce3930f213323bbc0afa9c55716b4e537
  • Size 45KB
  • SHA256 80fe040193ec7f8ca66789dfff9b4ddce3930f213323bbc0afa9c55716b4e537
  • MD5 d80ebb9c0ea487de8bd1401ffce7e022
  • SHA1 2a4c32bdb516ca94bc4506f926d42c8147f86b54
  • SHA512 63d2502910142ab88a7117edb43a491bf7430558e2aa27d981d7faea94d7b2c4c9e2ba0a1de36cd93c2e43337037b35202987895c3655c029b4a3889cf779058
  • SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7dCSwTMSPI5pjb4gX3inyWxyiuHFYx7ZEVVuiBDZ+:0ushJTDXgH2ogG5JbvXSyOyiAaZUVucM
  • TLSH
    T153231B003BE8C12BF27E4F78A8F26245867AB6637603D59D1CC441DB5623FC59A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2