Extracted

• • Target
    5ee2a588d13d1ab2f363c9664e30169e4b745790df7d7139693e5d4d6eaf8c88
  • Size 45KB
  • SHA256 5ee2a588d13d1ab2f363c9664e30169e4b745790df7d7139693e5d4d6eaf8c88
  • MD5 7de34d42a6c3d6a1164f733a74d5bf98
  • SHA1 cd7865b55077d33c516889a40cdd8f04f0a186ca
  • SHA512 449f576b177412e522a888a5200257de2fa1ac743a6ade5209c1ca75550e34bc39dc9d3f2ba8f397158ae715b359b485717b6b187d72a36d23da820e12d2c715
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9DiacyPzlOPIpzjb9gU3i4sCQCSBDZsx:EufspTf2g2uiVC3p3bqUS4xsdsx
  • TLSH
    T194232A003BD9812BF2BF5B7898F26145867AF6633603D64A1CC452DB5723FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2