Extracted

• • Target
    e4db582f4c43bf60b2d54ada77cbe8dc9d289f324a5cd9185405f65350e72f0b
  • Size 45KB
  • SHA256 e4db582f4c43bf60b2d54ada77cbe8dc9d289f324a5cd9185405f65350e72f0b
  • MD5 c367199b7708649a1d086646ac1db614
  • SHA1 08ae464f094c3b8bf0a5d55d602de946972af956
  • SHA512 ee3b5a57c4c1f226f7b332562fd56c6308dc78ef03daad51da204b09269ce0e3eb50975239025561ae981f2031942a1139f3945e809ddd5c373987ee4a1f1521
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9oozfy3CKPItWjbhgX3iLXXYSL5wrlZ+CBDZsx:EufspTf2g20TRtabOXSDX9LIldsx
  • TLSH
    T111232C003BE9C12BF2BE5F789DF261454A7AB6633A03D64A1CC011DB5713FC58A526FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2