Extracted

• • Target
    d3dfba1b5ac40d20b104277d40d1fda1e71fc0c4ea7b26d7bdd9166783a79705
  • Size 45KB
  • SHA256 d3dfba1b5ac40d20b104277d40d1fda1e71fc0c4ea7b26d7bdd9166783a79705
  • MD5 3af0b1f2ae955e69b85225dc3ff63adc
  • SHA1 44d0446cb8ba45f37aece3f43609764bdd5bfe71
  • SHA512 77076f4123b0ab57d41ce8d95c357409c215fa1c6c5b6ae9d23b75bb69837c20c2f4414c5b5b9b72b77ae5b6af39d0e502d54268997bb8fdcdc5c5904b4bb21e
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9tO5QSCBzHSNjPI7zjbOgX3idveCAg0QEAb28NNKiBM:0uPrpT/qY2cO59ESK73bxXSYCLEuVNKf
  • TLSH
    T1B8233B003BE9812BF2BE4F78A9F22145467AF6637603E54D1CC411DB5613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2