Extracted

• • Target
    02e68db33f3eda7c50cd450e37989ccf4a9834e728e72a97f4d6770137d16e7f
  • Size 45KB
  • SHA256 02e68db33f3eda7c50cd450e37989ccf4a9834e728e72a97f4d6770137d16e7f
  • MD5 1d1d45b448717b1e3e933c47980375f5
  • SHA1 c0a366bd17b36fda6b1b0023922b496c14f17bae
  • SHA512 1ae00a058d30d266cab43385f526d59d2f8529221d654c8488bf2a6e02fbf4af7465bea8bd8774b344c11bbb843211630e2edd97502c6fa4aa33bc0cec73bcd5
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9VCXtTtoPILzjbhgX3iwe6+1U4U8XLdoBDZsx:EulCJTHl42qw3L3bOXSBhjLYdsx
  • TLSH
    T17E232B003BE8812BF2BE5F7899F26145857AF6633A03D5491CC441DB5723BC6DA42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2