Extracted

• • Target
    eed1e0f5b848c327abdfd22c876b0cc77e6c0c7a6081002f040af1c96b2f597f
  • Size 45KB
  • SHA256 eed1e0f5b848c327abdfd22c876b0cc77e6c0c7a6081002f040af1c96b2f597f
  • MD5 feff3ac7bf92fa0bfa7cdd85dc40c004
  • SHA1 1b5697a70bbbe81449f663b8121aa7a5fec52f10
  • SHA512 6055cf2c75aa94da25801d9737c2ec9fe88ae931c4d443b25f26636beb390249429fb40552605d7ff4869a259c74b53a5339a75f3cee475ae906421749d7a401
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAjT2QAm7PI1cjbNgX3iAowyjkkruQ3RBDZcx:UuKWgSJTwRf2GT1sbaXSr9kkrf3vdcx
  • TLSH
    T1912309003BE9813BF2BE4FB898F26145867BF5633603D5896CC411D75623FC6DA426EA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2