Extracted

• • Target
    e5e2e6afb76fb896b11cadb3f51fbc675a80c48b20f3cd8f65256a13121bb6c1
  • Size 45KB
  • SHA256 e5e2e6afb76fb896b11cadb3f51fbc675a80c48b20f3cd8f65256a13121bb6c1
  • MD5 821be6db4f50dc3cbf302e927b2a96f0
  • SHA1 0d20d7e456baa3393765acc022e155514116cf37
  • SHA512 27032020968d2368b5d4a7e99cf4fb0623dfb2c119fbe541f488539cb9b822e5c6df5a1e9df3a20efba8aa997c405fba734e3891883856c4198f7d1095470494
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQ+eeXK5oibbb6TN8/nPI6WzjbYgX3i9FxGwz2pezMlc:cuqb5TrhG2LeEqTNKA6W3bPXS9KwCsQK
  • TLSH
    T101233B003BE8C12BF27F4F78A9F26105897AF2636603D54A1CC451DB5713FC69A52AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2