Extracted

• • Target
    e2e1314252df522f3f2d991734164dac303169cb399f4c143fe6b165ccd86169
  • Size 45KB
  • SHA256 e2e1314252df522f3f2d991734164dac303169cb399f4c143fe6b165ccd86169
  • MD5 0cbc9cafe645e48001ee64d4fd5e78c5
  • SHA1 f7a8bc0624040978fe5aea52606f1bef9bd48989
  • SHA512 d03596427395d60db3c0b7629e0c1e1a402e03d6bdd01435dbb8107544ffb9c0c7388c2518d40e1c2539326421de14d54024acd2094ac4cb570221ba42199e7d
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAG8V1yp7EcPIpzjbXgX3ikh1bfSWoH6umfBDZMx:kuSOpTPOP2W8V41Ehp3bwXSobfjvpdMx
  • TLSH
    T17D233C0037E9C22BF2BE4F78A8F22145867AF6633602D54A1CC451DB5623FC6DA526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2