Extracted

• • Target
    e4bb49ea103dc940b3740d407b4df50f5618b68419e0317f93b2da94662adf6a
  • Size 45KB
  • SHA256 e4bb49ea103dc940b3740d407b4df50f5618b68419e0317f93b2da94662adf6a
  • MD5 b3457b66b79026b48f9c834b0ba5076a
  • SHA1 03c171a15b12951c4796e57771a44c5f2a54ae28
  • SHA512 3f24d61cf643d687161340b2a7a6f38633ccce97ddd709ebd462a123ce369c15c9a503b7a8ecc1bfcdd13d7205ace057956254345c03307f6f438e383e7c6f63
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9x/NYssPJZOPIczzjbsgX9inI/nKqQkKoPf7Op8BDZu:EulCJTHl42eHIf3cz3bjXMI/HBxdsx
  • TLSH
    T110231B0037E9822BF2BE4B7899F26145467EF6673603E58E1CC451DB4613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2