Extracted

• • Target
    e734348eb1d7fc99592b4acd10172f8fca19e5cbd99b74a82bdfd70d0c42b76b
  • Size 45KB
  • SHA256 e734348eb1d7fc99592b4acd10172f8fca19e5cbd99b74a82bdfd70d0c42b76b
  • MD5 846eb063329b002b1ef3466adecc3dea
  • SHA1 6d2c05898c8aca4672dc4c13775d333b5f736f0e
  • SHA512 1f9a8a4f593ad37bfcf3055db5e52eda9615d34a77f2f0aebe7fd36c9f8ff686fd0d045ed5f9c90c6a746b0b9c7202b04aa251768ac085e9c10a5d0276aa5b9d
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9dEQL0Yj/OPIC6zjb/gX3iG56y/VQGeUSxBDZsx:EulCJTHl42MbT3C63bIXSG56eV9eLdsx
  • TLSH
    T11F2319003BE8C13BF2BE4B78A8F26145467AF6637603D5891CC451DB5713FC69A42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2