Extracted

• • Target
    0eac2531bd4f8fdc01135b56305ec77ce249b68d7a86f8ac8ff237c46374c9d3
  • Size 45KB
  • SHA256 0eac2531bd4f8fdc01135b56305ec77ce249b68d7a86f8ac8ff237c46374c9d3
  • MD5 7ab09489bfd986c493e555451291bc92
  • SHA1 49bb5e4501d087b7156563126cbe6809b9d6fc0e
  • SHA512 99120ed35d2cd2c3a3812fab2ba4966c6f200e618a16ba2d307bb3ae1c73ebd06faed6916e8a798df45dff3ae791449fc06ffbf602fa99b6514604fe7aee78a5
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAaL5P02FUFd8Ykk8PI+zjbBgX3ibmeh4RBDZMx:kuSOpTPOP2KLDmTB+3buXSbv4vdMx
  • TLSH
    T1FE2319003BE9822BF2BE4F7469F26145867AF6736603D54E1CC411DB1623BC69A436EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2