Extracted

• • Target
    e3c23f9e6d8c59682ccb458a491e493fc42d89a6a8d9b930a1825d167adfeb6c
  • Size 45KB
  • SHA256 e3c23f9e6d8c59682ccb458a491e493fc42d89a6a8d9b930a1825d167adfeb6c
  • MD5 2414cdc2f298a6fc735f5d7f21b97605
  • SHA1 625e030b07225030bec508eb0ec6b6c7844933fb
  • SHA512 3a595777e90773099dd914c5389deb3ad06dbff26f159fa98edc89804c2de39bf8ba04b6144a291a774d81e7d8d46c5b835f3e7c5af208e49c34478d1ea6f05e
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4gozHyvCKPIicjbFgX3ihYX5abPNBDZ0x:8uUIpT4vAj25L5isbCXShYX5aDDd0x
  • TLSH
    T11F231B103BE8C127F2BE4F789DF26145867AF6633A03D58A1CC4119B5613FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2