Extracted

• • Target
    ce57777fc1a0ce41830e29f4b33b1dd558e9760c3b3d3c4d7eb6a428c4fb48fb
  • Size 45KB
  • SHA256 ce57777fc1a0ce41830e29f4b33b1dd558e9760c3b3d3c4d7eb6a428c4fb48fb
  • MD5 52be12fe581831e9766e87c709a591e8
  • SHA1 45265c097058a409eda2e012f1ecac24277ebffe
  • SHA512 eef5f833b0a5f0a73e1be3b2ed7cc3aa4f8425eb7defaeaddc3c5ec40fee45a823845b491767b72a95ac2c86f5e090a815acb61692155bd1b88a92a088b5c4ea
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAhpt0CCM+d4CvS8PIMcjb7gX3iICP3FkMIC6+dBDZMx:kuSOpTPOP2x/CFWBMsbEXS/PWW66dMx
  • TLSH
    T1F1232B003BE8812BF1BE4F7469F26145867AF5732603D64E1CC451DB5A23FC68A53AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2