Extracted

• • Target
    e697ef9e6cae7d7b397e63acd1e7c18880e06979f31c6adf81933dc8be34a90f
  • Size 45KB
  • SHA256 e697ef9e6cae7d7b397e63acd1e7c18880e06979f31c6adf81933dc8be34a90f
  • MD5 e7a6e712195ebdd4a589bb519449d003
  • SHA1 0798bff14cfaaab650b1ba71f9f7cb63b32a5bc8
  • SHA512 cf7edba6380dfea301532a3cdb299e4bed5314245494f8490da4ba86f6e1cac1ccb46e93156ed8c82182dbca248dd4cc9ffef0e6cfda40926b67b66d709129a7
  • SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qFf9xY6aZOOPIrzjbggL3iOr7my81jUvY0BoBDZbx:4uLZZTUTn2Ks/O3r3bHLSOvl8avY0BO/
  • TLSH
    T1C6233B003BE8812BF2BE4F7899F26145867AF6633603D54D1CC452975613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2