Extracted

• • Target
    ec06525546060a93432d5299e2109dc4b4b74c73b7e81a48daa3a35c1573cbb8
  • Size 45KB
  • SHA256 ec06525546060a93432d5299e2109dc4b4b74c73b7e81a48daa3a35c1573cbb8
  • MD5 0615759742dacd7f5e1fb58df7072a20
  • SHA1 ffecb259955bd76264ddb837bc2695d595f1db26
  • SHA512 562e0429dd48e34e0a4c17f8205b15d5683eaa9b7d56b8aee4598f924272376b49f3ac12bc91c8133fa79811f61fd7c336630f74cd45d10088178f486a901977
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtjZbtDMQPI8HjbsgX3igpbu8wGb01cHvvluFBDZ0x:5udApTNmU2sJk8DbjXS+uR1ivAd0x
  • TLSH
    T1AE232B0037E8822BF2BE4F7899F26145467AF2673603D58A1CC451DB5723FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2