Extracted

• • Target
    e813ebc70c96379efb00e75ff50bbb1bd9b982f874d79dd3b12db28af75ae0c3
  • Size 45KB
  • SHA256 e813ebc70c96379efb00e75ff50bbb1bd9b982f874d79dd3b12db28af75ae0c3
  • MD5 a3af59696054b628236368f4d28f73af
  • SHA1 6bbab1c72c17400858cf2797e41a30f402295ecc
  • SHA512 7db038022b2d288920498c1a16ec8550da02d505c363f0d7e0ce2afce1b976fe4451e30c253b0440e72e350f61ffaa2b1b0d18cf07fb3d8b4f916c257ff9e7f7
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFvZTohEaSPImzjbtgX3iWvHmBgRjXUIVADBDZEx:MuLAZTnbg2O4Ea7m3b6XSAGBgKwAFdEx
  • TLSH
    T1A2231B003BE8812BF2BE4F78A9F26145867AF6632603D54D2CC452D75713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2