Extracted

• • Target
    e5ca70203ea5bffc6bd9164fad2f472710d2e0d1d2e2207e6166b848cd59b9c9
  • Size 45KB
  • SHA256 e5ca70203ea5bffc6bd9164fad2f472710d2e0d1d2e2207e6166b848cd59b9c9
  • MD5 05051bb44a222271fb782b3c2e4b57ad
  • SHA1 56970cb526cea3f6dd4b4f75f387ec59533f22d1
  • SHA512 050857da571e9c92012148d89b12a9694ef54f5fbc60bf47b995a65c9fed1c8e29dca2a9be9df9fa1bf502de29d9c08d0de82a71895dbb95b5932065680fee13
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1/fPLzizpvtLjZPI9zjbKgXhij/GlwJE2IhLIxPBDo:wuZ8pT1tc2WfHi1VjW93bdXwj/Glvg58
  • TLSH
    T1D7233B003BE9812BF2BE4F78A9F25245867AF6677603D5491CC451DB1723FC28A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2