Extracted

• • Target
    ea65655bab002ef65c1d281ea0b129e0594987f68ce55ff2848276b69a28358d
  • Size 45KB
  • SHA256 ea65655bab002ef65c1d281ea0b129e0594987f68ce55ff2848276b69a28358d
  • MD5 edef92e31df68cfee322a82a5991ed42
  • SHA1 f2c74667992b37107b735b118de270bdce4e1262
  • SHA512 5f6c08c564a5848989e920f573cc7c6cb884037b494696d7a953a4c9f36cf5d8fb8b44de7fd9d1f367b0116a8abfe1c9d72830af00c1a847a7e8209170d08a71
  • SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7DCOtTMtPICzjbwXgX3icuiE+HbfDnpBDZ8x:0ushJTDXgH2SRvC3bwwXScui5fn3d8x
  • TLSH
    T159232C003BE8C22BF1BE4B789DF26245867AF5637603D58E1CC4419B5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2