Extracted

• • Target
    ea18b988e0a7b5d0a6aad4cc7867a32b1ac6e6d6bf60f735ae95cd2ec8d447c3
  • Size 45KB
  • SHA256 ea18b988e0a7b5d0a6aad4cc7867a32b1ac6e6d6bf60f735ae95cd2ec8d447c3
  • MD5 c1cbfe65f80127adfb3133e50d58048c
  • SHA1 f44e55253bdb581c3f5ffa027b187aa378dc9aeb
  • SHA512 04f8a213ec1b21c04772c451b6aef2ba489c4ef640cb3ad0ee7a4bc1f3b04e64a1f977ffaf7c07e1e9a9d8ef37379e708c197279ea92a4482dc4a33bbdf10508
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQ0fBohEa+PIv8jb1gX3ijB9/A8sQjIRvyFlZPwaBDZW:cuqb5TrhG2a4EaHvMbSXSDRsQjIRvele
  • TLSH
    T103232B007BE8C12BF2BE4FB85CF26145867AE6736603D5891CC411DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2