Extracted

• • Target
    17b5203a5e5acf3d5d90bfab105cb5f7fc66f030e33829b706da0c62736f4102
  • Size 45KB
  • SHA256 17b5203a5e5acf3d5d90bfab105cb5f7fc66f030e33829b706da0c62736f4102
  • MD5 811e8b4de9be2551c20679a8ae660792
  • SHA1 4b15abdf831675f0fb8bd4763198956e0cdccc02
  • SHA512 842366d1bc46d2d5e2d7a02f0df7fb81a9be3533b5dc9b9ebe44fb0be71fcce48835fa497986761a431b1e4b6803ee61d9113b17e37b382eabed0ff795697f02
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlzfBohEaEPIQjjbsgX3iVcnzWrbV7PHDcENXNBDo:wuDWZTpMZSB2S4EapQHbjXSVcnCrcWD8
  • TLSH
    T182231A003FE9822BF1BE4F78ADF26145867AF1632603D6891CC451975713FC69A42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2