Extracted

• • Target
    ee22c01481b1b1180d2d899904a609ef941233c0a1224915cf13ea1a17a111e5
  • Size 45KB
  • SHA256 ee22c01481b1b1180d2d899904a609ef941233c0a1224915cf13ea1a17a111e5
  • MD5 4c0ceec5063536f06b2abdfcf4957a35
  • SHA1 b924467a6390873d3c2631c7bc8df8a1f7692047
  • SHA512 acfc2c88d2c24decb225af6675ef66150e8d000bbc181368706c6a80a28d202ab23ff5caff2295d1f7b89af2f0da957a22989c2b72eebce81e7c7a881b587fe6
  • SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7h/NYssPJZOPIczzjbYXgXFi02G6vC39nzA/eBDZ+:0ushJTDXgH20HIf3cz3bXXU0n6vABd8x
  • TLSH
    T116232A0037E8822BF2BE5F7898F26145867AF6633603D58E1CC441975613FC6DA42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2