Extracted

• • Target
    e5cbbfa5d120a9ce70b9ec08a507b9acfffaab15dbdb387c860f6e9f93782c44
  • Size 45KB
  • SHA256 e5cbbfa5d120a9ce70b9ec08a507b9acfffaab15dbdb387c860f6e9f93782c44
  • MD5 fa0e6ce4daea6f3d688218f7f7443997
  • SHA1 6d44cb7b04b36910be34e1b15fb0aedb005f7738
  • SHA512 ae6bb7048c30e76cb1c7fe43fb5015da8e87db2ff9131021f4b63fcb834a589cb1e61f1c9c3c4ef73c63f2c8af1e017e7a35a19dd6528ee94b5873bc5aea6737
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q112q0CCMPd4CvS8PImHjbUgX3iw1oZZGcHSNBDZMx:wuZ8pT1tc2MRCEWBmDb7XSwteSDdMx
  • TLSH
    T11B233B003BE9812BF6BE4B7899F26145467AF6733603D64D1CC441DB5623BC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2