Extracted

• • Target
    e0cfe512cf23ee528d87e834cc81867ade58fdea281212d0b7d6078cee3a6b81
  • Size 45KB
  • SHA256 e0cfe512cf23ee528d87e834cc81867ade58fdea281212d0b7d6078cee3a6b81
  • MD5 1a4aef16916d89df973834c41d6e7ffb
  • SHA1 251047a6ee92e1c1b2e643a59ca7e0b98b968566
  • SHA512 64cd5f0d6fbe114b67b4fa723fa16d3d50867cdcf009747d69f37998e767cfd013dbc1bfd6d141bd76bc36ec642bcc0f5b096b80c4565a3a59c0723eaa7915eb
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9wO5QSCBzHSNjPI7zjb1gX3i8UuDUJdpXtSpgBDZsx:EufspTf2g25O59ESK73bSXSNfJTtSp2c
  • TLSH
    T17323190037E8C12BF2BF4F7898F26145867AF6633602D54A2CC451DB5613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2