Extracted

• • Target
    eb545ee5e76b45ecb9297bd3400bd741bb2d51d8d8bfa7ad3f26a82121446344
  • Size 45KB
  • SHA256 eb545ee5e76b45ecb9297bd3400bd741bb2d51d8d8bfa7ad3f26a82121446344
  • MD5 ade3edf7a4291df0e739cf3842bed9cb
  • SHA1 810534c60206a63853bc9ddf9f3b638f3f8814a7
  • SHA512 02fbc9fe15e3db676384d1e238e4a7d93010a0bd430d57d2eee5509b224eb9535570a6bd5881a635eeea27e1eae4f93876145f1e5f804747736ba5802a771067
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAaLiE0yFjrdjYkk8PIu5jbYgX3ijRJHsB4p9U1BDZMx:kuSOpTPOP2KLBXQBu5bPXSdeB4pAdMx
  • TLSH
    T168232A0037E9812BF2BE4B746DF26145867AF6733603D64A1C8451DB5A23FC68A436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2