Extracted

• • Target
    ea821bc5f70df24417b9b9ffd3eee661ed77340b8fe39f354734e1827f3e41f0
  • Size 45KB
  • SHA256 ea821bc5f70df24417b9b9ffd3eee661ed77340b8fe39f354734e1827f3e41f0
  • MD5 a33a875fa62e165f9f9d4d7bb7ecae7c
  • SHA1 f5253bc26c0e9cf1505855edb423a42c3a6c7676
  • SHA512 3e07d711ba166e3fababf3a9d6de88d17d71febcfc88fb3627f71df704cb0f40b739ee7e7bda26f39ba36423305ab29fe53ba982902653574bb64b8758798249
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlNls/cPEaRPIxmjb3gX3iOXBAztLBDBDZMx:wuDWZTpMZSB28+aEaOxKbQXSOXBAzhn8
  • TLSH
    T1EA231A003BD8822BF2BE4F789DF26145867AF2A37603D54A1CC451DB5713FC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2