Extracted

• • Target
    ee86c63f1b786f4a032ee3dbde579a28310e29e1b569b854d2aa35e050ae337c
  • Size 45KB
  • SHA256 ee86c63f1b786f4a032ee3dbde579a28310e29e1b569b854d2aa35e050ae337c
  • MD5 04f4cca76b15031451e38054acd783b3
  • SHA1 c8a2933d9a5b375644be1b446217fcf992d07b9f
  • SHA512 7229ed30a1b8c5d5e1c1b028678e882acda73dc7b5a711af8183bb745d6d1e47927c9094c1dcd284de12fc4761d249d45c97be939408578406cf02c687dbe537
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1a0e3NEAKViZPIazjbAgh3iggPopMTdI4vxf8HOBDo:wuZ8pT1tc2t3exiWa3bnhSDPos0gdMx
  • TLSH
    T192231A003BE8812BF1BE4F7899F25241867AF5637A03D54D1CC452DB5623FC68A53AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2