Extracted

• • Target
    e002e48427f3463a5d85d433ba7117347f2fe2989ffc003a4800a99f534fb73f
  • Size 45KB
  • SHA256 e002e48427f3463a5d85d433ba7117347f2fe2989ffc003a4800a99f534fb73f
  • MD5 ad96744913b7696d50a0afa71140dfa3
  • SHA1 46c50d338846a900a4dba8b55b35fc4e816c1c93
  • SHA512 06d9f550da25ce75476d34b505c4c10983b006d3ff4051b72d504f9dc88559f623d4684230c8b3ea78a62464dd04e4f3ac9bbf071b9c0a8de697dbff4a63d5f9
  • SSDEEP 768:QulCJTHESwgWUK3aGmo2q9BGFZQjB4PIFfzjbWgX3idp2E2b3SO1Cg2abJAaXB9R:QulCJTHl42FqF9Ff3bJXSdpn2mOT2gJb
  • TLSH
    T1FC232A003BE9C22BF2BE4F78A8F26145467AF6633603D5491CC451DB5613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2