Extracted

• • Target
    ec1ff8afd8c11c062ee86be71b75ae117332c1e343cf0d88ca19f9147095dff6
  • Size 45KB
  • SHA256 ec1ff8afd8c11c062ee86be71b75ae117332c1e343cf0d88ca19f9147095dff6
  • MD5 82d48d6176a65b20029018b1547544ff
  • SHA1 72391c3962e2e8662cf4c9c256d47a26fe383f07
  • SHA512 b1a1becbc3d30ca7b8d48d71427cd9730d0e72f87136584ddd46a7ff6bdb19c19320fb7adaa513834c0f3fa7b290705ec089568d1dc9f142878f281b69e93ff0
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAjT2QAm7PI1JjbQgX3iBIIQmq3TJVBDZcx:UuKWgSJTwRf2GT1pbXXSBh4dcx
  • TLSH
    T1B5232B003BD88237F2BE4FB8A8F26145867AF6637603D64D6CC451DB5623FC686426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2