Extracted

• • Target
    e99e908089861ec7cea0a4e3f83c54bdebf69dc221a1d82c5c487db792abe7fe
  • Size 45KB
  • SHA256 e99e908089861ec7cea0a4e3f83c54bdebf69dc221a1d82c5c487db792abe7fe
  • MD5 661c3f17b902f3d21c49fe83b8bcd1c5
  • SHA1 53f083f8972ccd5249ee00f94317cebb175cbf42
  • SHA512 f55e3e2287588dee2304ccec40b69556cd70d9fa3e4d49a5d76c58a4798549629a850d89d172fde1818cdfa893677657b2293e08e6b9b87e0b2781a5ce6b61b3
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1B3wZQaKkPITzjbagX3i27x+OABDZcx:RuxkJTgip2nIT3bNXSGmdcx
  • TLSH
    T176232B003BE8823BF2BE4B786CF26145467AF6633603D5496CC451DB5723BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2