Extracted

• • Target
    eee2a50b99c13971c7b8056e28c184a5a110fa0c7cbad7943284779b50c3f693
  • Size 45KB
  • SHA256 eee2a50b99c13971c7b8056e28c184a5a110fa0c7cbad7943284779b50c3f693
  • MD5 519d9000ee24cef8c9c7ef0af4085a2d
  • SHA1 27f4bc3b92b7421d4e30cc5e9b09744989f6975c
  • SHA512 d7fb662fb537be76fb3c9d469c69b623e77c2e6d80d2e708250a6502fd82124c08eb7866fbe05001417ffb2d4bcad6543df42e6f60b9cded2380cf36b20cadef
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAW0ewtDc30oiZPI/zjbQgX3ibzK7CXE1TmjnYBDZMx:kuSOpTPOP24wR2iW/3bXXSy7CXE1TmjB
  • TLSH
    T18F232C003BE9812BF2BE4F7869F26245867AF1636603D5491CC451DB5723FC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2