Extracted

• • Target
    acb80e750def111053fd4612d138fadbea77eb6e298bce83ace871e06f3b6b29
  • Size 45KB
  • SHA256 acb80e750def111053fd4612d138fadbea77eb6e298bce83ace871e06f3b6b29
  • MD5 bedd71f217f95e7374e703ca94508f51
  • SHA1 4f99a69a0b4436a10294dac2264865a42bfc4381
  • SHA512 0e5e229559c8de73420ee87807a8e487ee10455ab9fcf430b499648b2df1da7077b8dd75122733b77c60ff6053d586b7d81ddfcb1db3dd967b338c9f3744627f
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9ORz3wnOPIBzjbGgX3iYf0wDwYPCmAcZ5BDZsx:EulCJTHl42Pz+3B3bZXSYf0wDwYPCadc
  • TLSH
    T14C232A003BE8812BF2BE5F7899F26145867AF2633603D68E1CC451DB5613BC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2