Extracted

• • Target
    e5a404d71605020bd76fdfc1a94a1447940e9a0e698d27facba8366014b95f36
  • Size 45KB
  • SHA256 e5a404d71605020bd76fdfc1a94a1447940e9a0e698d27facba8366014b95f36
  • MD5 23e86193e8e93c1e1da1e31fa1084c1f
  • SHA1 b7ac3e84c0aa3d976bdd12724175103fe1476784
  • SHA512 93b7088e43645ab1b8194dfca10321c548aba2bd28b190ab15a20b20e3b4328977078fccffe3c2ea85716bc321263a79645c5727f2933d7e2c48cc5739a0cc78
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4IozHy3CKPI2SjbXgX3itwatAqIYJK8BDZ0x:8uUIpT4vAj2xrR2+bwXStpJLd0x
  • TLSH
    T1E5233C003BE9C127F2BF4F7899F26105867AF5632A03D58A1CC4119B4723FC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2