Extracted

• • Target
    e1573a3c921c437eb88cf4f90d1b9ed56f44a03d17a1340c004d8e7acb35b6c5
  • Size 45KB
  • SHA256 e1573a3c921c437eb88cf4f90d1b9ed56f44a03d17a1340c004d8e7acb35b6c5
  • MD5 390c4c0bf74768569d270c3b537de94e
  • SHA1 85068c4eb5abf4bf7b53a6b7096988763d289588
  • SHA512 78c3fa5549760e992e1c49b53f8c95fdac63f0a94b0612e14c8db4d2239324b13e04e69726d090348ea2934bdd5737c86d660e4a46a2303e4854c8cec7bbd23d
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAaLiE0yFjrdj3kk8PIhxjb8gX3i5zuDXvj44f5JX/oG:kuSOpTPOP2KLBXDBhhbTXSw/j4CXQpdO
  • TLSH
    T1BE231A0037E9812BF1BE4F74A8F26245867AF6637603D64A1CC451DB5723FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2