Extracted

• • Target
    ed134b8e2f8acd612bafbc4d3dbb666ab74eabf229eb18ffd76aa8d2017b3f2e
  • Size 45KB
  • SHA256 ed134b8e2f8acd612bafbc4d3dbb666ab74eabf229eb18ffd76aa8d2017b3f2e
  • MD5 d19ebc8f675a43872c034a132c1a40c9
  • SHA1 ecfa17c2a9450ff982ce51b6315db573fc6dc397
  • SHA512 3de8e24714c080745a3e00f1f46da301fc82319e77af007ba0ff456d3ace54f815c79b2b1d63063c34390a9cee2b8a1c1ef3697e4b46cb137f876b7301eff634
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAT0ewUkA1MiZPI7zjbngy3iAmqV6S6ekip8BDZUx:cuqNJTLr62nwvDiW73bgySw6PezEdUx
  • TLSH
    T1A0232B0037E9812BF2BE4F7859F26245867AF5632603E5491CC451DB5B23FC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2