Extracted

• • Target
    e22d4eef009acffd9c0d7c0fb4955bc972d35bb319821514dbf68e2b52ec4e5c
  • Size 45KB
  • SHA256 e22d4eef009acffd9c0d7c0fb4955bc972d35bb319821514dbf68e2b52ec4e5c
  • MD5 ee8dc698f66535aba073d89d933c9af1
  • SHA1 8776ceb0fc44badfb65c421f490d037ec113d267
  • SHA512 29b5fc9e0351325f1c4039c58d4d05cdf57eb1ae2bf1a5063a73956734825cccba7425d05b0b8aab8b7fcc977410610d7280ef2beb7152dd25728588af3d1ce9
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFPeeXK5oibbb6TN8/nPI6WzjbkgX3iY8P0O4NoE+Zu:cu7e5TH2A27eEqTNKA6W3brXSY8P0O4p
  • TLSH
    T1DA230A003BE8812BF2BF4F7859F26145867AF6632603D54A1CC451DB5723FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2