Extracted

• • Target
    e4ba83173ef0e919603b10d95306483873d4de4beb815d8deeca908c44cdf871
  • Size 45KB
  • SHA256 e4ba83173ef0e919603b10d95306483873d4de4beb815d8deeca908c44cdf871
  • MD5 ccb7ee4c578220d46adcc412f5dd2803
  • SHA1 e026f899176ce58961243fee5df32108d9062a58
  • SHA512 de1c622524ad9a7c8bef8ca68b1144e9fe6fabecb175bfbacf1288ea3e1e0c0f509dc4f81454bfe315dd4133078c5d9ad98042976803e7114ce78620619a1166
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9D9Y6kq/zNOPIyzjbQgj3i83G/F84zBDZsx:EufspTf2g2Oa9C3y3bXjS8mFXVdsx
  • TLSH
    T1F2232B003BE9C12BF2BE5F789DF26145867AF1633603D64A1CC4519B4613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2