Extracted

• • Target
    e7d5c643b4a0fe7003db007c9583fd88bdcecd7195f2558d4bbb9b736283bce4
  • Size 45KB
  • SHA256 e7d5c643b4a0fe7003db007c9583fd88bdcecd7195f2558d4bbb9b736283bce4
  • MD5 4e9c8c795becac551fdf2d4513ac74f8
  • SHA1 0801d764a31f66d07e84c870b3d269740f237f71
  • SHA512 fee0d842ee130cb6f1a32dc3e0eb710dde8c0a4a459a80e544f13677da51768281e987e8bffd2be0b8b0b8b6066e91cd7c7d5fa734c5dc71e593176a31630ac4
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAT0ewN1A4NiZPIazjbtgW3ieSadXTNxbtW6pTBDZW:cuqNJTLr62nw33iWa3b6WSeSadDVtp10
  • TLSH
    T16F2319003BE8812BF2BE5F7899F26145867BF6632603D9491C8451DB5713FC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2