Extracted

• • Target
    ea4f20c36ffe80f49f7028180a402664837c0b4385dad230c728e7f8b96922c4
  • Size 45KB
  • SHA256 ea4f20c36ffe80f49f7028180a402664837c0b4385dad230c728e7f8b96922c4
  • MD5 0542c02ebf77add5382f77375b50f6ff
  • SHA1 31b85c4253aec5477204e12d43174e81ef29ba39
  • SHA512 b873deb0301f24c9108900dcd6a85f7e4cb2997a26021d7aaedad147912d9b3f30c6d57204286eed105a57161d481aaf7a9d990c9ac3b5ac5dec12a68823b0fe
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q18Q0D3+/vPPjZPI7zjbLgy3ibElxvEP9dlqDfBDZUx:cuR0JTPjY2DP32/jW73b0ySbSJEP1qV0
  • TLSH
    T1BC233A0037E9812BF2BE4F78A9F26145867AF2732603D6491CC451DB5723FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2