Extracted

• • Target
    ea3976efcf49b353c5a7094516549462bc8754bd58ce9c375fdc064ba032405b
  • Size 45KB
  • SHA256 ea3976efcf49b353c5a7094516549462bc8754bd58ce9c375fdc064ba032405b
  • MD5 3459d087a70557a26ecc51ff6c90367b
  • SHA1 e5beedb34167d1c6f1d8fbdb131791bf20828765
  • SHA512 3b84cbea37d60369565e343cc434b48c880fdc9fcebc05348c4deb0bd8b24bea72a5fcfb857234ee982bdd8a2d40ad970a70ce93541bc9bf605d86e34db07d1c
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1zGsGxgOHuPIazjbUgJ3iGJu3TmyoiTFBDZcx:RuxkJTgip2+e/3a3b7JSh3TmyoiTLdcx
  • TLSH
    T1FF232B103BE9812BF2BE4FB899F26145457AF2633603D64D2CC441DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2