Extracted

• • Target
    ee7a9ef08c788d20c522a4f16b0d0cceb966976308c4b8400920db39474137b2
  • Size 45KB
  • SHA256 ee7a9ef08c788d20c522a4f16b0d0cceb966976308c4b8400920db39474137b2
  • MD5 58d99e5029b6f91c1e78fd4c5b28abf3
  • SHA1 adb51cdbc45966b1db655c1fb0ea05c18f4e11e9
  • SHA512 d9930a74081ab4d80e526c3298aeba28a51940f780e230eec6c5f67fdef185d430b93fb7e4fd1d8abca49b7f80c7c1ace8f41c2715c1cfed12e08de0b8f22745
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1ebqYGYjHuPIAzjbugXLi1g6gZORmEbygTETjtcBDY:RuxkJTgip2zd/3A3bRXG1l5ETQdcx
  • TLSH
    T12E231A003BEC813BF27E4FB89CF26145467AF6636603DA492CC451DB1623BC6DA526F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2