Extracted

• • Target
    e96331f810175372deeb7bcd38ac285bcdeee17c29a4ce1358e3a9d587513325
  • Size 45KB
  • SHA256 e96331f810175372deeb7bcd38ac285bcdeee17c29a4ce1358e3a9d587513325
  • MD5 e42c095fcdfc9046ec687343d4e73488
  • SHA1 f09deaabc56c38c339aa855ede626f0b584ba808
  • SHA512 2ad26c5981d40a8ce8e0aa8eefb76f34e35ae669ec260d8b2100800036333d51f05c44977abf85746d989f49781abd1af62ceb85abe741484b6d312e4cdc9088
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9yiaLzwJAOPIcFzjb/gXGinOXJGpBd1uuxDOuXjXwxt:EulCJTHl42l5U23cF3bIXvnZpxuuxDO1
  • TLSH
    T195232C0037E9812BF2BE4F78A8F26145467EF6673603D68A1CC451DB5613FC68642AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2