Extracted

• • Target
    e116d2b31f4704bc58d2ca9d17dbce12155dc1782f2807d10e2c02ffb1169909
  • Size 45KB
  • SHA256 e116d2b31f4704bc58d2ca9d17dbce12155dc1782f2807d10e2c02ffb1169909
  • MD5 47e47202548e32ca28124a195118f672
  • SHA1 85f67c3e73038a26146a76d9ae6f16e043c5e8ef
  • SHA512 5710fb8e37c0ed9f34228ca900d751ba2816f488265554cff09519af6b007ce3e3d7a8b46811781e41c57d17e15f0a1f49061bf1ee970ebe928f08b6babb0fa6
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9q9YqPq3hOPIezjbCgX3iAyigkfeFnBDZ8x:0uPrpT/qY2Haqq3e3blXShkfejd8x
  • TLSH
    T123232A003BE8C12BF2BF5F7899F26141867AF5633603D64A1CC452DB5613BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2