Extracted

• • Target
    e7e308aa2c6f4710d89bf7e0e3e43b99ed3ae944eb2dd5197427941e7e4ed505
  • Size 45KB
  • SHA256 e7e308aa2c6f4710d89bf7e0e3e43b99ed3ae944eb2dd5197427941e7e4ed505
  • MD5 9f3606a04d9b1ae0eeab0f38b1a4c10b
  • SHA1 cdfcc829f338748ead178d0a8ff891ec83f422aa
  • SHA512 245813818acc758982e233be5eac3600fb19971444307e3b0d2d09d302979fbad300951bcea91432ab64cfa51c99b8dc10f796bd89b4dc7ff23e4fd36e0ca4b2
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9aCSwTMSPI56jbvgX3iXLFsx2Exx8OUMzuNBDZ8x:0u1YJTHcw2NgG5WbYXSXGxNn8OcDd8x
  • TLSH
    T124231A003BE8822BF2BE5F78A9F25145867AF6633603D5891CC441DB5723FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2