Extracted

• • Target
    e318b8577dc51515f35fd417b9fba533a91a164b51bd2899d88b955c4d767e8a
  • Size 45KB
  • SHA256 e318b8577dc51515f35fd417b9fba533a91a164b51bd2899d88b955c4d767e8a
  • MD5 5325c748b473f253705235de5bac0c8a
  • SHA1 55ca15fe06d0c672349b7c7f408bf01e6ff81a6e
  • SHA512 6c7271af647bec54ea7bca1fffa12522f20376b775255d5fa570ac793a3f75e5b540c55b0cd53d29afe3a87cab2c9bc9da95de703fbbd8c45ba6415a76a84b19
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFtl9fcBEahPItQjb7gX3iG3I1Vgc2e9HmIfyBDZUx:cu7e5TH2A2ELkEa+tYbEXSYI1epeFH00
  • TLSH
    T15F232B003BE8822BF2BE5F789DF26145467AF6633603D58D1CC4419B5713BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2