Extracted

• • Target
    ce2a2d5f19d8c7c478eac9e65cd6064fae48d6d2da5c216a824c0a08477f0c9f
  • Size 45KB
  • SHA256 ce2a2d5f19d8c7c478eac9e65cd6064fae48d6d2da5c216a824c0a08477f0c9f
  • MD5 1c481b876e5e6efdf3ecb99597510bcd
  • SHA1 8f1ac994be1b582f65dbcefb02c7a8c473cbaca0
  • SHA512 e92096327910e8a40a8741942c21661aa113bdd85c2a250c2ebdaacb9b411831706e10038f880544ee6ed843eff8c1008d7c2765eaa11e23323b76554f5914ff
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9wO5QSCBzHSNjPI7zjbQgX3imEGxN436hYPJw6BDZu:EufspTf2g25O59ESK73bXXSm036qPJPc
  • TLSH
    T182233B003BE9C12BF2BE5F78A8F26145867AF2633603E5492CC451DB5613FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2