Extracted

• • Target
    212f0eca19eed38f78ae78a66ef7f3f392412065458154260112df85e4cee121
  • Size 45KB
  • SHA256 212f0eca19eed38f78ae78a66ef7f3f392412065458154260112df85e4cee121
  • MD5 3f1aeda7fb4d59ad9465551336260ed4
  • SHA1 aeaa73426389217c2f7f58b27c3c04886a502fca
  • SHA512 73b30aedf689c092f14d8d55ab5c8e0d6ba54b4360cc1bcd15eedc5adde90d34b0ada7120370d5c00b3b2754b3b932f6faa6cfcedccbbedc98e9881d95f31923
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9tCSwTMjPIuWjbRgX3iSZujeB5GmnbgoBDZsx:EulCJTHl42ag1uabeXSYuj05ndsx
  • TLSH
    T1E5232B0037E8C12BF2BE4B78A9F26245867AF5633603D59D2CC451DB4623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2