Extracted

• • Target
    ecb1391ddef1a393fd3c6af2b8b13a1958dd37c1bb7dfe94706f708a6cd8a08c
  • Size 45KB
  • SHA256 ecb1391ddef1a393fd3c6af2b8b13a1958dd37c1bb7dfe94706f708a6cd8a08c
  • MD5 b235e60f3db197219637e83891357db0
  • SHA1 7abe009456d5914132d8bf20dbe98101be79ad07
  • SHA512 ce7dd6db351fe8adf820b3bc640b6871b4e2a68e4876d93a3562ea5637f539ad94d08dc2862d968570b9165acf80206adb0dbd866c356d9a16b3aa3de675e6ee
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9UHO9YjoHPICYzjbbgX3iUpKs6//CV6rZgVBDZsx:EulCJTHl42A6kgCY3bkXSUp0/qV6rZkc
  • TLSH
    T10A232B003BE9C13BF2BE4F78A9F26145867AF6633603D5491CC4519B5623FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2