Extracted

• • Target
    e357f5561ef6cdbab4fe23e440a5faaa21718a2b9803590de646bce73ec373a4
  • Size 45KB
  • SHA256 e357f5561ef6cdbab4fe23e440a5faaa21718a2b9803590de646bce73ec373a4
  • MD5 c90495d19cf813a17191910b7135ef97
  • SHA1 500d621ac17b60bb0415a4b958828094a761f100
  • SHA512 7328aa438a13205fa87d8275c66c01709cc174e8af9bbc54008ef115e38a8a7890f479a738b98279ef239609615cb5951cfbaeea20dd5a9da3ce1ed07b94fb06
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1/fkLyuObvtkjZPIuzjbqgXriNBuJSW3gSBDZMx:wuZ8pT1tc2WfLuyyjWu3b9XmNPW3gsdO
  • TLSH
    T16D233B0037EC812BF2BE4F78A9F26145867AF5673603D5491CC452DB5B23FC68A42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2