Extracted

• • Target
    17ef5613f98a9c4d7bea2bcd859319817137a4261b71ffa6f0c6fd9dbb9fe617
  • Size 45KB
  • SHA256 17ef5613f98a9c4d7bea2bcd859319817137a4261b71ffa6f0c6fd9dbb9fe617
  • MD5 dba5e830a67b99e54bb30316dd056082
  • SHA1 0f62bd93b211e074acfee9ea212911bdfabe7cd1
  • SHA512 f925db3abf76c06295d9843d7b5a6c221cf8d86cee08f5e6ab7e1f420fbe3f1ddea16970a80ec0b60500e8c433011003568c740a1f699ccf8c71bdd7d9164bfd
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1Z0ewnScqe5iZPIEzjbQgX3iDrX+ibPbAWaPtBDZUx:cuR0JTPjY2AwSMiWE3bXXS3X+ibDAWaw
  • TLSH
    T1FC232A003BE8812BF2BE4F78A9F26245467BF6633603D5491CC451DB5B13BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2