Extracted

• • Target
    e27284189789e62ca84ec87532503204cddb81baa708a033eed8e2841a63a629
  • Size 45KB
  • SHA256 e27284189789e62ca84ec87532503204cddb81baa708a033eed8e2841a63a629
  • MD5 6d7949bdd3cfeaadab71cb15b4e4ee0a
  • SHA1 566f863a92383350766730e05bfe7929d5032084
  • SHA512 daf5b17c7fc905a386272d902cf42da599102eccfa5ceae913b956fc30a5b06136d2de8c2e0128c03f27256c58cbbf8c7d9a2d781fbb114a96ecfad0ae5e538f
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVsg0enWbcKnCfPI0zjbMgX3iQbvaVce4P8CJIq7ecm:MuBGJTPho2lSnyq403bDXSx2ltIUdEx
  • TLSH
    T12E23290037E9812BF2BE4B7899F26145867AF5733603D68D1C8451DB5A13FC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2