Extracted

• • Target
    efcd2ef5cc8692ee31b892bdeabbdf2de3250a628e439875d2a2252208a4a84c
  • Size 45KB
  • SHA256 efcd2ef5cc8692ee31b892bdeabbdf2de3250a628e439875d2a2252208a4a84c
  • MD5 bca4e51db97240c25874c71802f607e0
  • SHA1 de2cc04fbf81e2e2880c125b27a56453a495e550
  • SHA512 c798f87a89155e659fe369bfab00f3290411bdcb7516bbf9b489727cbf172eb143143515640dc6f9d1d2b9bcd8d0c436458c37595574500b97a7f5b4670a285a
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlKzdAAyPMlL8TfPIMWzjbdgX3NdreVFOB5BDZMx:wuDWZTpMZSB2/lvlL+4MW3bKXd1aEhdO
  • TLSH
    T1F0233A003BE9C12BF2BF4F7899F26145467AF2633603D58A1CC451DB5623BC69642AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2