Extracted

• • Target
    ec1905f38ab48a5a2b2a7c5c4023b08a602c36de7d13a01c0281882a974c6c16
  • Size 45KB
  • SHA256 ec1905f38ab48a5a2b2a7c5c4023b08a602c36de7d13a01c0281882a974c6c16
  • MD5 e8c85633833a89fb74b4b9581245a391
  • SHA1 0c11f11feeef2bdc580ca29dbd3c15c9443f0b68
  • SHA512 8a3aab6bdf192ddee9bad3196ff06c312d8961c5f8638816ebecf1b94774c7bededc89b6c4159343dacd77ff324bf9de4701ed0b6efc5eeba672242a7c04b1cf
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1w0b3NLAteiZPImzjbLgU3i4aoNITK8gJBDZUx:cuR0JTPjY2a3ZhiWm3b0US4aXjgXdUx
  • TLSH
    T102232A003BE9812BF2BE4F78ADF26145867AF2632603D5491CC451DB5613FC69A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2