Extracted

• • Target
    e02d9589983b8fa0d61f405f6cad3343f649c9860ef31805fb6fa02ddec86679
  • Size 45KB
  • SHA256 e02d9589983b8fa0d61f405f6cad3343f649c9860ef31805fb6fa02ddec86679
  • MD5 0ee2a81bddb32b5bf405a7fd6b1fca35
  • SHA1 def6c175d8374349fbe8e0883729dd8e6874e2e7
  • SHA512 38fcb49720222e13437a9a8bdb099b67f46baa31797c9f66aeb888a7a48c01bbb3bb4ffb08a9d436f129d78c8e475f7a51552e8876fefa45813f1649fd982e17
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q94OJQ4CBQnSNjPIyzjbogX3WodJnHzIM5S4hBXrQii:EufspTf2g2ROJznSKy3b/XmoLnkM5dhc
  • TLSH
    T11C233A0037E8812BF2BE4F78A9F26145867AF6633603E5492CC451DB5713FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2