Extracted

• • Target
    e275f5e4674889e532cd75efd32411eb2e6e6eb19ceb783c7819956231595ce6
  • Size 45KB
  • SHA256 e275f5e4674889e532cd75efd32411eb2e6e6eb19ceb783c7819956231595ce6
  • MD5 85bfb925c8f09b0c5ff374e02ab914bc
  • SHA1 b0f8faa47b3e258f84ebd3697a75efdf5b0b1c57
  • SHA512 4d7139f7f23d9ba239dd2fe892f2d1195aa9d86679388ef6fe4bd687b80ab94449e5e4ca30563a689e43bd8d8b8702c99fea3415f6830075f2ad6765e9c8d570
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFPeeXK5o5TN8/nPI6Ezjb4gX3i6ZRt5f75prBDZUx:cu7e5TH2A27eEoTNKA6E3bvXS6Zr5fbC
  • TLSH
    T125231A003BE8812BF2BF4F7899F26145867AF6633603D54A1CC452DB5613BC6CA52AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2