Extracted

• • Target
    ea8e78995a0cd1a566457497f938c8c51d3782bfec3238a6ab1c6f2396e85ebc
  • Size 45KB
  • SHA256 ea8e78995a0cd1a566457497f938c8c51d3782bfec3238a6ab1c6f2396e85ebc
  • MD5 771a2743165202ddbd59a9a6d33b7f57
  • SHA1 66883fbae62ba84500dcc30fcabc9839b0bdefbe
  • SHA512 97a0f2baaed1f8c9db33ca4d3c98f491f408860561e195255328cec969cbe01978b1deadafad11a45527a7abdc75c86dbed9c67cf51a3eb532d3043287c58454
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qw8fBohEaEPIQUjbfgX3iw1HwQwbLDIBDZMx:ku40ZTXEb2C4EapQ0boXS4wbLSdMx
  • TLSH
    T1962319003BE8C16BF2BE4F78A9F26145867AF6632603D64D2CC4119B5713BC6D6426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2