Extracted

• • Target
    ef10ba7167793c2cff759872069a94a9d97d51c9b7dc7c0f0262cc34e8fd13bf
  • Size 45KB
  • SHA256 ef10ba7167793c2cff759872069a94a9d97d51c9b7dc7c0f0262cc34e8fd13bf
  • MD5 841786d271dceaed082702e5f98f44ae
  • SHA1 15505d0b84064cf35f7a07c1ccbe5a554a74276c
  • SHA512 a0ef6cc90b0ca2b782bab9e323d45c7b95e36a76060571b9cf4567b7f092d4c84e153bd275a164de2636fa4093156c8141149b5a5eb480b943c40d33b5a4e9ce
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9BHO9YjoHPICYzjbBgX3iS4/pvalwEjLlQyLCBDZ8x:0u1YJTHcw2x6kgCY3buXS3pWws18d8x
  • TLSH
    T1D2232A003BE9C12BF27E4F78A9F26145467AF6633603D64A1CC441D75623FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2