Extracted

• • Target
    ec3403dea1e260cf0462e851879052c0571a29008646abd57bd85c55fed19841
  • Size 45KB
  • SHA256 ec3403dea1e260cf0462e851879052c0571a29008646abd57bd85c55fed19841
  • MD5 d51cd36f8bcc4319a4c8cff180eed210
  • SHA1 37093a3383bf0627fa31fc57e5d22cecd2c84ba1
  • SHA512 5e3bfaed1ae1deb9283b634cd4eca64322d20dd2ad77836fe40444447904f6210903b212ff95327b23f8039b538ba584181a7a20c9e2c6dbebd0cb048e951634
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qldeeXKSocbbbQtN8/nPI6kzjbRgX3irsZZ7xgt7F:wuDWZTpMZSB2FeH2tNKA6k3beXSrsnVy
  • TLSH
    T164230A003BE8C22BF2BE4FB858F261458A7AF2733603D55E1CC4529B5713BC59A526ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2