Extracted

• • Target
    17de6ca7adff24ddb9d4d081f21b77d40fdcc7b93e5d8dcff4d1b6ee08e654f5
  • Size 45KB
  • SHA256 17de6ca7adff24ddb9d4d081f21b77d40fdcc7b93e5d8dcff4d1b6ee08e654f5
  • MD5 9a4de187861d4f4434dd945a4e2d7f9a
  • SHA1 e1d18c274ea8e4fc4a3cf707fb8b3427dd7fdc02
  • SHA512 ec4a6fa2d5fe4a73a1b631b7b902ee0385b232fb66e0b59615ab4b50e04ce6e2172141d42bba27546003387149e6d1a1a29909d225e2d38a6a333bea014697cb
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlN7lH440WMOPI0kzjbqgXRiXjB7OfAV2kTUzX9pu:wuDWZTpMZSB2oqUM30k3b9XAzdWAVdUO
  • TLSH
    T169232A003BE8C127F27E4F78A8F26145867AF2677603D64E1CC4519B5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2