Extracted

• • Target
    257f2f7ee96b12929e7f74042e782e4c49720bed0283b4d09e69a05b8b539378
  • Size 45KB
  • SHA256 257f2f7ee96b12929e7f74042e782e4c49720bed0283b4d09e69a05b8b539378
  • MD5 7ccf2594ab60ca856443dae3e73fe1bd
  • SHA1 d7f1ca1257537f9d2e275e4bd8eb0f3a84047f61
  • SHA512 0b37e1f8a11a8deab366467e21fde0be8db5b580b58aa758c7d790a4ef9a4009870099144558da1335409be57871d673e6a7f7d11613dd5592788c6518db8fe6
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9tCSwTMSPI5YjbdgX3iE90iStOHLFeLBDZsx:EulCJTHl42agG5QbKXS/ihYdsx
  • TLSH
    T1E0232B0037E8C12BF2BE5F78A9F25145867AF2633603D58A1CC4419B5723FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2