Extracted

• • Target
    17ce318ee4e9b13b8db946ffd3c09d33deed74cacf6966f1b9de8ba37698272c
  • Size 45KB
  • SHA256 17ce318ee4e9b13b8db946ffd3c09d33deed74cacf6966f1b9de8ba37698272c
  • MD5 3b49ab208c232db9e9eab18dcd34c023
  • SHA1 033c5eb3870b2a59fa9ae6411a1f2fb465af389b
  • SHA512 3789181cbd937de2fecb7a49655ba7ca09263e1e995028bedcd2d91fff1c8eb677d3e43865d38558b9362cfcaf5bfe5800e70d28d08209016627eb12f2a33d34
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qldeeXKNoRRR8/nPI6GzjbEgX3i/eSCJT64BDZMx:wuDWZTpMZSB2NeQIRRKA6G3bLXS/rA6h
  • TLSH
    T1E8231B003BE8C12BF2BE4F7899F26145867AF6733603D54E1CC4519B5613FC59A42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2