Extracted

• • Target
    e55c56df0407214f9a65b3f6c0af347b6e4293b41c3bfcafaeb21c3585b18823
  • Size 45KB
  • SHA256 e55c56df0407214f9a65b3f6c0af347b6e4293b41c3bfcafaeb21c3585b18823
  • MD5 77cc6d22955a157e91456dc54b5383fe
  • SHA1 25acbbcc96e3594f816fe69e852d4d34e301e671
  • SHA512 8d0da3e0caac60a9c1a9a6c8e685eac83089022899099df25a7f8a95f0f7ba21a3ae4d0256fc34a6b43a7c92d1dcb535f6813454f8980db7337af6a7e9a00528
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qASqyx0OFUwdrxIkDPI9zjbvgX3ihS6xNno1BNpKQh:cuqNJTLr62iqKTNM93bYXSQ6oSBdUx
  • TLSH
    T1EA23190037E9812AF2BE4F7899F26145867AF6733A03D6491CC441DB5B23FC58A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2