Extracted

• • Target
    ebca0054df964a9d204f441d699913e5087e35476fb9667416776671adb585cb
  • Size 45KB
  • SHA256 ebca0054df964a9d204f441d699913e5087e35476fb9667416776671adb585cb
  • MD5 10e533c75d32e67e1a2d4d7d4aa3fc1e
  • SHA1 31b205749b5c9bada26bdcc7a267111a3017b801
  • SHA512 fb11ff858633b164a41ae9d09fa04668a7b0a2ee0f8adeefad18d72ef55ca47efa6764d76dc124e714ea4b838d2239f0953762caa02159178d3f17b1e34d962e
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9aCSwTMSPI5tjb4gX3iyCJNqELGkZzBDZ8x:0u1YJTHcw2NgG5lbvXSyCJNq5kZVd8x
  • TLSH
    T172231B003BE9823BF2BE5F78A8F26145867AF5672603D54E1CC441DB5613BC68A436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2