Extracted

• • Target
    ef8e055bba27386ad7d824a0aa189499460a6649dfec820de1d6d92050dade93
  • Size 45KB
  • SHA256 ef8e055bba27386ad7d824a0aa189499460a6649dfec820de1d6d92050dade93
  • MD5 8e48b3a2263b017028b656f201c03f5c
  • SHA1 2d0994b21de9b5951b511f7e46a411f95d909bdf
  • SHA512 e444618ed1b0137485276ad37981c45063aeab26e63d5f24589b6af6a6d108d8b277ee08599e5794c4fb42df69f2164e6d32c92dc607fc2e5cf59c9abe2a7720
  • SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7sZoQTMtPI4VjbigX3iLCh+nd7dG3BDZ8x:0ushJTDXgH2vL349bFXSLdExd8x
  • TLSH
    T173232B003BE8C12BF2BE4F78A9F26245467AB6677603D64D1CC4019A5713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2