Extracted

• • Target
    e9f5e68f58cf646d04a5a8651b7a0e153f5e16e0589eec738af9ea210b6f4382
  • Size 45KB
  • SHA256 e9f5e68f58cf646d04a5a8651b7a0e153f5e16e0589eec738af9ea210b6f4382
  • MD5 594daa18ffb7423d7c6455e5f03af141
  • SHA1 495c107983c3735bbed0f31c1d5da9044a0c48fd
  • SHA512 c1bf27c0ceb20d6043fc2f7dadb375996d865f8c567586974c6c00f2f450f6f899491070b114ef53b9874caa9c7e0e24496d68d9060a4ad51c2be0b32a51ae29
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe8V1yp7EcPIpzjbkgX3iR+u/BDZEx:MuBGJTPho2t8V41Ehp3brXSjdEx
  • TLSH
    T109233B003BE9823BF2BE4F789CF26145867AF6632603D5491CC451DB5623FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2