Extracted

• • Target
    ea897b51bd3d86f0e5bcd25fcf3a96db6fa53363511cdf9c4272939ead4b2e76
  • Size 45KB
  • SHA256 ea897b51bd3d86f0e5bcd25fcf3a96db6fa53363511cdf9c4272939ead4b2e76
  • MD5 90a096a39a6f589c267e21a58c626be8
  • SHA1 2876df5823830f57f7b7abef32af90d27664bbe1
  • SHA512 890c651d7518b3d2a4bad19aea0358359924c5735bdce7d11ed8caf9d3adf00f3bae205f86eee930bfbbb21dcc2c9f56b5c32bf1e565761258d52eac06b4994a
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwI3HO4SNMOPI0mzjbZgM3i7IvZ5McBDZMx:ku40ZTXEb2M+JM30m3b2MS7iZLdMx
  • TLSH
    T189231A003BE8812BF2BE4B78ACF26145867AF5737603D94E1CC452D75613BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2