Extracted

• • Target
    e7d08edac18bd229c094809fdf75e5f64d6a5300e052e7f811f8ab2ae39b354e
  • Size 45KB
  • SHA256 e7d08edac18bd229c094809fdf75e5f64d6a5300e052e7f811f8ab2ae39b354e
  • MD5 18f74825ae74e3b3cee2993a9d24f623
  • SHA1 a172efa19a4dc6cc770f1878b98e37f79c36dab2
  • SHA512 fdecf872241bfa02f96d3c6bd3d2825c9226fba48596671440d97a84c1997288cb9c9a15dfd192ec2577f3749671be3cb78bd6b3aa76cae52798f8421470fb71
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVCHUttXAPIV9zjbtgX3nYwaZnGgYFmN6VBDZkx:suJdpTPdI2f0rXlV93b6XXYwapGes7dm
  • TLSH
    T151232A003BE9812BF2BE4FB4A9F26141467AF6637603D64E1CC452DB5713FC29A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2