Extracted

• • Target
    e07224d8ce4263c35f1f000c1087239c2f378b9f4e7962781df9ad80b33c7630
  • Size 45KB
  • SHA256 e07224d8ce4263c35f1f000c1087239c2f378b9f4e7962781df9ad80b33c7630
  • MD5 f47c77ca39caf3a13d4b60b3968048ff
  • SHA1 8526183d718a70d7090f432b8fdd92152802b68d
  • SHA512 f1eac8388d90574d78dd269ea783514b94b9d219511c8fc21867f7deef5379839bbd5d6cfd54b3b37a09db797fb940503f5df0752bf4ff2f10d2aa439a578a83
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYjK1YJBOPIxq7zjb5gw3iNXagfXeSQ6uG09BDZ0x:8uuSpTgyf2eiz3xS3bWwSNKgWBg0Td0x
  • TLSH
    T1B0232B0037E8822BF2BE4B789CF26145867AF6677603E54E1CC441DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2