Extracted

• • Target
    e2c7fdb71fccc867220b251e876d33c7824941fb2af27e29ef7e1fc9fc902a9c
  • Size 45KB
  • SHA256 e2c7fdb71fccc867220b251e876d33c7824941fb2af27e29ef7e1fc9fc902a9c
  • MD5 2bfe2eda8155f87f9f976c0ba54af976
  • SHA1 e071c557b453f404b04736725cab69533ff44dd2
  • SHA512 6e6bda9fe54e30874feb56e9f9040cecb1cb7825c6a91dd331fd539643b60a7ab1b49c59434b7ee2211c1a753eb36bbb801121ef9b053401f0e1da22697759eb
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwW3HO4SNMOPI0Vzjbmgh3iOI+5VYuoE/BDZMx:ku40ZTXEb26+JM30V3b5hSOdVYnydMx
  • TLSH
    T186232B003BE9C12BF2BE4F7898F26145867AF6672603D58E1CC451DB4713BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2