Extracted

• • Target
    e87b5058a6380ad589ec270394cb9cc29d24fcd519368b9e974866ced99e419f
  • Size 45KB
  • SHA256 e87b5058a6380ad589ec270394cb9cc29d24fcd519368b9e974866ced99e419f
  • MD5 42b909e30e31b9ae45bbf5b4180baa96
  • SHA1 c6af30520f951dcdbddf4e7588a0e6a24056fbe2
  • SHA512 0ef0592aded5667c7e4b0beb5dbb01b6493868f0b322e4f7e983a7639aef7936ec121539bc586d7d81087b9c2358abec13da6e60f2c727f157a481bc3a29ae3d
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4T9YikqHztOPIUzjbqgh3iGvQQsGBR8IjgEiJsBD:8uUIpT4vAj2XalK3U3b9hS+dRIcd0x
  • TLSH
    T1AC232A003BE8C22BF2BE4F78ADF26145857AE2633603D64A1CC452975713FC69A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2