Extracted

• • Target
    ee53a12d05c5cad9d56525431d4d8bf82a5c25c7b9bd716eed46ed6dcd88ee78
  • Size 45KB
  • SHA256 ee53a12d05c5cad9d56525431d4d8bf82a5c25c7b9bd716eed46ed6dcd88ee78
  • MD5 5fb67f2f34b85dd3e7c0be09e7162f25
  • SHA1 5e64ed7b969ab39da841c5cf3918f5d18527b0aa
  • SHA512 e68cfd395a31049b6ef160e726710816f245331f1eb1ba1ac4be7d7fdb7a35a00b5bbdf03033f19b4775ed27afdfcd64a7f57684d8b6cc82879874b6d7b7ced6
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9nDEbHBOjTOPI/Tzjb0gX3iwdAa8hsPrbBDZsx:EulCJTHl42IyYf3/T3bbXSYAaO8rNdsx
  • TLSH
    T1F2230A003BE8C12BF2BE4F7899F26145867AF6673603D6891CC441D75613FC6DA42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2