Extracted

• • Target
    e00411ddbb8ef57db31b0dd22ec175407d0590c2c1d1ddcb44460cf8293e8de6
  • Size 45KB
  • SHA256 e00411ddbb8ef57db31b0dd22ec175407d0590c2c1d1ddcb44460cf8293e8de6
  • MD5 9ea71d92aa53aa4f180ba7aa3c28aaeb
  • SHA1 0be898bd6efce6cf2ae0e0ecaeea7866950b6d6a
  • SHA512 77b84b2ac698b14f458bb6ea285ab142810035ec2084906b824ea012d5856da2d48db19a949215d1ee57d393f58886c1d8cdd2500ba1cf7f55c02880aa216266
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9zCOtTMtPIPzjbRgX3iUVNiKchmBDZsx:EulCJTHl42MRvP3beXSUKXhodsx
  • TLSH
    T14C231A003BE8C12AF2BE4F78A9F251458A7AB6673603D54E1CC441DB5713FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2