Extracted

• • Target
    ec2c56cc429cb6d9fff2548bc58206ee8059d28122f2f65dc13700e07e64fedf
  • Size 45KB
  • SHA256 ec2c56cc429cb6d9fff2548bc58206ee8059d28122f2f65dc13700e07e64fedf
  • MD5 1c957d9dbb6b680096c793fd86eecf54
  • SHA1 46753b5c80289615a44dffa3e9ad4b9457e4fba1
  • SHA512 7c7b96c7a5d58741f5c9203e1f5c918d214e772403caaa170f050b0d36bd6d5871bc28b1081bfc026d662e6ee0bf64d6b6c16c58a548748ff46b4031f5946c87
  • SSDEEP 768:QulCJTHESwgWUK3aGmo2q9BGFZQjB4PIFfzjbbgX3iU+FAASndIvBDZgx:QulCJTHl42FqF9Ff3bkXSJFVSmZdgx
  • TLSH
    T1A1232A003BE8C12BF2BE4F7899F26145867AF6633603E5491CC451DB5713FC69A42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2