Extracted

• • Target
    eaab52f922929321608d1b43004b0388509a1c0a5f8021e3e70c65de63ac035a
  • Size 45KB
  • SHA256 eaab52f922929321608d1b43004b0388509a1c0a5f8021e3e70c65de63ac035a
  • MD5 5bbb46b0e9dc2f29301c2a54b89cfeee
  • SHA1 be272d8a0f3331b393cdd26c1b9b344f45361d32
  • SHA512 6e4718596b682ec431dc7820ff7749d33404c3d59d633bcc4ed6d6f0c77f6d3e9a95050f494883621403b6669e2ef1e3fb7fb096626ef0a032793d69993c56a9
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9x/rLzlJAOPIc6zjbVgXeiUD++L8HQmMBe/a0tsueBc:EulCJTHl42ePp23c63byXnUH8HHMBe5R
  • TLSH
    T13F231B003BD8C12BF2BF4F7898F26145867EF6673A03D58A1CC4519B5613FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2