Extracted

• • Target
    ef9e6b090e34abb378556645233ff5fc7663b5bbf0bdd15b82a65f4776fe3a35
  • Size 45KB
  • SHA256 ef9e6b090e34abb378556645233ff5fc7663b5bbf0bdd15b82a65f4776fe3a35
  • MD5 6698796080f11acf010dee38c60c1d36
  • SHA1 6e2ef88140b8a870d99689617b581485d20522f0
  • SHA512 d77dc8fb0060c008caa2ce89cbe6ccd24811d16925845830d5b500b682b39867048d4fdf8925ea42799d2d20445cd3415d78d2551c110e554f66dd2bcdc1bfbf
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q11maPAlU3API9zjb3gX3i2ky7EDqpY9BDZcx:RuxkJTgip2AfAS3l93bQXSc4Dqpydcx
  • TLSH
    T1A0231A003BE9812BF2BF4F7898F25145867AF6637603D64E1CC452DB4623FC69A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2