Extracted

• • Target
    63d58eec411c2b32e22cdc8e33fe5870dae0e6e4c472f6263ecafa516afeced1
  • Size 45KB
  • SHA256 63d58eec411c2b32e22cdc8e33fe5870dae0e6e4c472f6263ecafa516afeced1
  • MD5 344bde93bffd02349ae7dabc67f97e35
  • SHA1 86b1662569e243614ba84fb28308c93b12b6e7d9
  • SHA512 bf7acf9242cbe2a3b85c675ca7b507e32f1a8f2bb60fec4fa654ec141e4755aa37912fa434678cfb89538b7b141cb263ada40e95c3246bbe6655daf63c6bf33d
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9zwD/y/aqPIUzjbDgX3i7vs2j81w7vBDZ8x:0uPrpT/qY2QkhU3bcXS7vs2j8qd8x
  • TLSH
    T1A5231A003BE9C12BF2BE4B789DF26145857AF6633A03D6491CC411DB5723FC68A526FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2