Extracted

• • Target
    e491d3fca57ea52e6d7e599e75a7c5dd2438f7780fc324ef32f3d1081bb0d701
  • Size 45KB
  • SHA256 e491d3fca57ea52e6d7e599e75a7c5dd2438f7780fc324ef32f3d1081bb0d701
  • MD5 812db11cc57aa2ecc1f851ba0281edd4
  • SHA1 e9aa0f8f1f278817f02492e4ffaaf7bdac9e6fc1
  • SHA512 c8f99e407cca8afb2477ded387aaaa083292f1f30c539cc1b1b927bb7c1e5482512d65d0248a78683371ce465fee51cd27312f1a19656188a7e6c96c155cd6e5
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98zjHy/aKPIbojbRgX3iJA/Q/8lo1fMBDZsx:EufspTf2g23nhbAbeXS+Fdsx
  • TLSH
    T1D2231C103BE9C12BF2BE4F789DF26145867AF6633603D6491CC411DB1713BC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2