Extracted

• • Target
    e25e125699b3430babaf8b542ada0a483ac405ee2bd6871045ceac1bc8593d72
  • Size 45KB
  • SHA256 e25e125699b3430babaf8b542ada0a483ac405ee2bd6871045ceac1bc8593d72
  • MD5 1506fba0b1fcc74155549b7b8bb94fcf
  • SHA1 6799443b7542b7f2e1fc1dd7008143403ef0f9dd
  • SHA512 d6a1fbeda2b4822dc082c19d3824d5c504d24cb6a5b8705e311760fb942a692cfc1a482020135324f3b6c35dcc8c3822f0dc5d35f6a671bb1e8347f02228b32c
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9yiaLzwJAOPIcFzjbpgXciYQZOmbYk9RD5rBDZsx:EulCJTHl42l5U23cF3bmXZYsORkF9dsx
  • TLSH
    T1C3232B003BE8C22BF2BE4F7498F26145867AF6673603D58E1CC4519B5613FC59A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2