Extracted

• • Target
    ea5e640e7a3f40f744df2c84bdb94d7042f244feb474a6ddf9fc7a46ab85da66
  • Size 45KB
  • SHA256 ea5e640e7a3f40f744df2c84bdb94d7042f244feb474a6ddf9fc7a46ab85da66
  • MD5 29aadfe4745bcd9e366ebd48e6ca3c2c
  • SHA1 34ea2f8d33c3794fcfeaca75e91668d1d3375342
  • SHA512 edf59978f9bc20d5f3d3aa686d2976888493546788916a97fffabee8c4cb6c75e7ad46fe07f72def7a7530d22e05f9541c14ddaefad827587ad0bd7157a443aa
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2ql43FoDEaOPIUzjbKgX3iyIR5/vRtAlcSyKMBDZMx:wuDWZTpMZSB2J6Ea3U3bdXSn1AlcSyKt
  • TLSH
    T177231A003BE8822BF2BE4BB898F26245867EF5B36603D5491CC451D75713BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2