Extracted

• • Target
    e2a1c29aa150cbab3ac0b9c2d9d794febab591486886b71d80b3566222fa69de
  • Size 45KB
  • SHA256 e2a1c29aa150cbab3ac0b9c2d9d794febab591486886b71d80b3566222fa69de
  • MD5 b0d7ed9df898fc2a400a23d225e31de5
  • SHA1 efcb0e53c2d778b4ad31f811b4a25549bb4c3115
  • SHA512 9815a7733d314a37cb871f0a2c6d77bfed8f783de3fa602dc4dbb58d0d1f943467f33f999efd2ee6f6ab33b29001d0c07f7a930134dce6f397d7e2bced055e4e
  • SSDEEP 768:QuflpT8AkKuWUch7wmo2q9dO5QSCBzHSNjPI7zjb6gX3i6hiaADiBaBDZTx:QuflpT8Hv2sO59ESK73btXSOKtdTx
  • TLSH
    T180233B003BE8812BF2BE4F78A9F25145467AF2637603E54D2CC452DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2