Extracted

• • Target
    ec47eb4cb35f3f3a570c9be58d1748182af29681d8e454a5ccce45bb8766ffc1
  • Size 45KB
  • SHA256 ec47eb4cb35f3f3a570c9be58d1748182af29681d8e454a5ccce45bb8766ffc1
  • MD5 477b71363cf7896ece169344f5844162
  • SHA1 3e9624ab37fc21d7142248e065458ac01e342ab1
  • SHA512 7c5f67315bf24021e4ed4af0401429788ed018624c42ec04e5d1206ad2d69f221821cc00fdfd8d0d13e0bd2638f3ffcf32e783f189a0e953375cae8167e0515d
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtkZo3TMtPIm1jbogX3isZ7p1y4H9qmBDZ0x:5udApTNmU2lU3mdb/XSsZ77jFd0x
  • TLSH
    T152231B0037E8812BF2BE4F78A8F26245467AF6677603D54E2CC4519B5623FC68A427FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2