Extracted

• • Target
    ea8d95190cf864f2267185ba689ae345c3a0ba846091f66da6e8fc53d7e52750
  • Size 45KB
  • SHA256 ea8d95190cf864f2267185ba689ae345c3a0ba846091f66da6e8fc53d7e52750
  • MD5 af6d98f596bd206b676b26c3b1c493fe
  • SHA1 b5cbbc127564eead5bf226afe4ef52453fb77d3e
  • SHA512 75dc7e4ced5ee7d66fe13d427be12e4259d2bf38da819b0c73aab9ef868163575cd078f094a8720f35dee0e0a2637121086e96f977ed70d3d626f04b7df2bc4f
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9wO5QSCBzHSNjPI7zjbggX3i31MFFf3G9HBm4BDZsx:EufspTf2g25O59ESK73bHXS3HhVdsx
  • TLSH
    T131233A003BE9813BF2BE4F7898F26145467AF6633603E5492CC451DB5623FC68642AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2