Extracted

• • Target
    eb14e9d8240077502aa33633fd040a2042c895838bcaac2e4dd16c56ed8323b4
  • Size 45KB
  • SHA256 eb14e9d8240077502aa33633fd040a2042c895838bcaac2e4dd16c56ed8323b4
  • MD5 7a8453a08113b346a422d54f9dc3dbf8
  • SHA1 910c454f6ac3724e55c4666be1d6f8c8855b3db5
  • SHA512 cda48a6c17f2270f60c2b603c5509ac5e56d80e22bdff9d32ac81117556cf7bfd301b60e20706c6c9058f3b415d5856916b76d7ba5ab15d6c9f1635d99258d2c
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9BHO9YjoHPICYzjbCgX3i6xgLhnL8Y4GZiWBDZ8x:0u1YJTHcw2x6kgCY3blXSEgLhHJd8x
  • TLSH
    T15D230A003BE8C22BF2BE4FB8A9F26145467AF6636603D5492CC452DB4613FC5DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2