Extracted

• • Target
    e87cc3ac19b04dcb7f2ffce53223c4d40512c878e77a6e8973a9b79ddac49c55
  • Size 45KB
  • SHA256 e87cc3ac19b04dcb7f2ffce53223c4d40512c878e77a6e8973a9b79ddac49c55
  • MD5 6eeb3456d3036bbc2acbe8d1e5f23f4f
  • SHA1 ea0811a7940ae58fadb1ea795a87a1d9095b0e1a
  • SHA512 bac5b401012431e35f025daaadc733cd3e4680295503604d40655644a08495777c9be11e4618cb03c92b005da0d497496fc0e39f0d23d3844b002864b1b41cd3
  • SSDEEP 768:Iu5KkpTsU6Q8WU+xjamo2q1yT2Qpm7PIKhjbUgX3iQgaEIOWHOh+/BDZLx:Iu5KkpTsx/2ueKxb7XSQDLOeJdLx
  • TLSH
    T17C231A003BE9813BF2BE4B78A8F26145857EF5632603D6496CC452DB5723FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2