Extracted

• • Target
    e44a618c77f9b09b80c9cba89f78f11573a18d8a5b088212a4a5d4fe8e801494
  • Size 45KB
  • SHA256 e44a618c77f9b09b80c9cba89f78f11573a18d8a5b088212a4a5d4fe8e801494
  • MD5 7872b98bf542be84ff5a7ebf16856150
  • SHA1 3d42e233f7259f61e1c5146b50be33335f3c9334
  • SHA512 54f36b66b0c47431b924537419cbbc22081733d96b979cc6ae8aac1fff102385d744df74f7bdeee3e813c7d0dfd837ed999886e37e5e16db95a9a1f630ef2856
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFTls5ohEaMPISBjbagX3iY861FUZvkQLDBDZUx:cu7e5TH2A2m44EaxSRbNXSRvFFdUx
  • TLSH
    T1D5232B003BE8822BF2BE4F789CF25145867AF6A73603D54A1CC451D75613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2