Extracted

• • Target
    ead358e80773fb16c68956b3a752c8652363081b6acc73d1d5ae9457ac9c796c
  • Size 45KB
  • SHA256 ead358e80773fb16c68956b3a752c8652363081b6acc73d1d5ae9457ac9c796c
  • MD5 7c5c2d24c9b6f1dc81a6378b60ced3ea
  • SHA1 aeea778ca5e4e48542fd44bff4b306a69e13a54f
  • SHA512 9eb8da1440641cf64b62b3258e7c04e49286c56b6193fb64736f0836a8b3a5a8e4a4dab82810dc7352855ee1a546de460bb98f7a8b7e25129bda6e73f99896af
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAG8V1yp7EcPIpzjbmgX3iiliRbSdjYAeq9BDZMx:kuSOpTPOP2W8V41Ehp3b5XSiliE1TdMx
  • TLSH
    T1A2233C0037E9823BF27E4F78A8F26145867AF6636603D6491CC451DB5713FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2