Extracted

• • Target
    e07ca9a0e8c61c434b7fda986835d7dceaaed80b8a3a969e86c77970b8d98ac5
  • Size 45KB
  • SHA256 e07ca9a0e8c61c434b7fda986835d7dceaaed80b8a3a969e86c77970b8d98ac5
  • MD5 1aaef0c2ab7f6944a934424a5ad9146c
  • SHA1 0a3c39459e75d89072ef0c5756d9631c1b5b76da
  • SHA512 94d357e369dd654c97c70e1a195d1b38b2e9f4bbd49d1893e854f15a15dec3694a9fdf86170ea8160eda7c4993524a96e05525e566d209bc6fec45e8c0d91ac7
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF7fBohEa+PIvejbHgX3ipK0Cpyhk3BDZUx:cu7e5TH2A2q4EaHvSbAXSpK0CohcdUx
  • TLSH
    T1BC232B003BED822BF2BE4F7899F26145867AF5A32603D54D1CC411DB5613FC6DA42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2