Extracted

• • Target
    14cea90496aaf55f9b832c84d8673ff0ef6c8af8b0d9dbb3f9cf3b634e938bae
  • Size 45KB
  • SHA256 14cea90496aaf55f9b832c84d8673ff0ef6c8af8b0d9dbb3f9cf3b634e938bae
  • MD5 0bf04db40f6c5c4798f83bc72a667065
  • SHA1 b2e33b0441d320d0990f7076cb9216e699a06b05
  • SHA512 e1f67e1a44093dddbda0d6a1030640342d511516496ea060d0d01b00563a6d80f43be7ae5a44a264e88dd3d73fe17819d9e7dea56d389ce639dcfd9ece6c02b6
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q90ZbtDMQPI8pjbGgX3igYQdZuAAgavQhrqdBDZsx:EulCJTHl42lJk8JbZXSgfdZuAdaaqzdu
  • TLSH
    T1AF231B003BE8C12BF2BE5F78A9F26145867AF2673603E54E1CC4519B5723BC58A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2