Extracted

• • Target
    e0f7155f055726c145a709288bfa2312cadb50a6ccd3491a799fd08b1ba17f7c
  • Size 45KB
  • SHA256 e0f7155f055726c145a709288bfa2312cadb50a6ccd3491a799fd08b1ba17f7c
  • MD5 3acf7ebaf972b0b45d44bf0ec8bddd6d
  • SHA1 f7ff9f5193d21b798fb95842d42d96138116c7e7
  • SHA512 54549fed1cf1968a807fc57959e9fa7bac3d0eafecff475da8ee54a657e0f8eb38fcba8cbb0086f590b3cd25ae0432fbbe9dfef0f051a1810ea19708f6bcfa13
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1nT9Qpm9PIKzjbggX3iu7BnjkJbmuBDZUx:cu6YepTPso2GQK3bHXSykVPdUx
  • TLSH
    T1E3231B003BE8812BF2BE4FB898F26145857AF6672603D54E2CC451DB5723FC6DA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2