Extracted

• • Target
    e2551e1410937c6f91d2dbf9e82a7dd5d51f552c3f3e4f4aaa02b14ff3ea7498
  • Size 45KB
  • SHA256 e2551e1410937c6f91d2dbf9e82a7dd5d51f552c3f3e4f4aaa02b14ff3ea7498
  • MD5 fc8b92625ae319d9b63e34d46a09f232
  • SHA1 01d54b890673a17efad075b3937bfb84bacce9b3
  • SHA512 a33e14120dfef5ef2e05e97fed7a92ab244c7b9fb3976d347a48acfdbf8c1cc4a45b6a822ff838767550260d01d876c9abb221b0ddb4322a9fb9d69acc73c3ad
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVDbT0GYjHuPIpzjbngXOieMf7HOeGEJWwUqkBDZkx:suJdpTPdI2ms/3p3bgX3e87u7w4dkx
  • TLSH
    T18A231A003BE9812BF2BF4F74A8F26105467AF6637603D64D1CC452DB5623BC6DA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2