Extracted

• • Target
    eace789eee1435b5610930e0ca4b3ca6744af73656ab53c8fa0606b180e77a28
  • Size 45KB
  • SHA256 eace789eee1435b5610930e0ca4b3ca6744af73656ab53c8fa0606b180e77a28
  • MD5 ca16fa4e15776ac7f5df606d0fe39725
  • SHA1 04052e07374feb41ce27bbff50693fc25e5d989d
  • SHA512 a8e2e4163edc0530720d3c6dd32f8f16df7a6465505a209a2b4bd18b594b7205bd9a23f64d4ae142170b9cb85305193c201a3af64b47dcb590934e509752d6c3
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fLiE02FjMdjYkkmPIwzjbGgX3i/3rBSxbTtqKqDoN6:cuR0JTPjY2SL9wQPw3bZXS/r8b5qpoV0
  • TLSH
    T1F2232B003BE9812BF2BE4F78A8F26145867AF6732603D64E1CC451DB5613BC69643AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2