Extracted

• • Target
    eefa0c3dcafcb35f67e8c5898e406ba2cd7366ff28540c24f09d650710f5a10b
  • Size 45KB
  • SHA256 eefa0c3dcafcb35f67e8c5898e406ba2cd7366ff28540c24f09d650710f5a10b
  • MD5 1f33766e4c218597efd8b5eb05c294e2
  • SHA1 cf62eb0afbd26307edb85bfa0a3f31de52be9a41
  • SHA512 c37e01b5dd63839ef36b0e285dd93fa441de35347b017b039e5c97d57d8c07c309fb6d1328cc76c8201ab548e70b9662927dfe612ad1cc64bd157699d261224e
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qr2GsGx8OHuPI2zjbNgQ3ir1e/0xTeSUNnJXD2BDZm:vuogpT7I62pez323baQSr1e/0xiSUNlj
  • TLSH
    T1E0232A003BE8812BF2BE4FB498F26145867AF6633603D54D2CC452DB5623BC6DA526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2