Extracted

• • Target
    e4a26090712dd0aea0e88a8d586f7e20960f9cbc5887d90e073928312df05ae6
  • Size 45KB
  • SHA256 e4a26090712dd0aea0e88a8d586f7e20960f9cbc5887d90e073928312df05ae6
  • MD5 4270c06689956a7faea606bc7d909c87
  • SHA1 97c464aa1a63ce02c65f6b8479be8d758fe3f2f1
  • SHA512 f12d1dce4633486f902d3d6b0b685f6ce42da374e7885f605fc9dd0984147ba752a4129b73562639676c2cec934b3a06bad8da01ae6c1aee98b83aa83d582be0
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAeb30GYjHuPI8zjbAgXHignLMofzKwKhBDZcx:UuKWgSJTwRf2uw/383bnXCgLZfjGdcx
  • TLSH
    T102232A003BE9812BF2BE5FB8A8F26105467AF1736603D94D1CC451DB5723BC6DA426EA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2