Extracted

• • Target
    0e225d02acdf5f9986fbf5858de3aed43bf2104aab00d83ad189cf2d301233f6
  • Size 45KB
  • SHA256 0e225d02acdf5f9986fbf5858de3aed43bf2104aab00d83ad189cf2d301233f6
  • MD5 d8f498db84bfbe2cc8ee4be9e4bc6b5b
  • SHA1 69c8eb6b5fa7987b956cde7450e0d257a76b1ae9
  • SHA512 123c03a719d90722b5604937bbaf0a8f13ca1fdc70a530c9ee10a77d2462d18cbced0f7abed0603c7189455379003a98504e834a9a1c1379d91a88cb1c5f2abc
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1IBz3QKx7PIQ7jbIgX3ixXzcmtxHZe62BDZUx:cu6YepTPso2NV0QvbfXSxjcmtx5TYdUx
  • TLSH
    T1452319003BE8823BF2BE5FB898F26145467AF6633603D54D6CC451DB5B13FC68A426E9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2