Extracted

• • Target
    e2d023f6c3530bf1f541ecb4c31210588bc3a8955586d01e9bf85d9545e00b12
  • Size 45KB
  • SHA256 e2d023f6c3530bf1f541ecb4c31210588bc3a8955586d01e9bf85d9545e00b12
  • MD5 e23d2af9075b39965f1876ae24557398
  • SHA1 22a1aca39528e1bc0da41b1ff550b0ff9822b974
  • SHA512 c9ee42374d0d249e7db13fa733a52a6b46c3492fd098de19c9a9dae042a7d4bd3a83b9532d666bbc79796d9233c36d102877787b6ed20680f6941489ff8caf7a
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1Jw0QbKXPIvzjbxgX3iOu3F1O1bCu/YNdBDZUx:cu6YepTPso228v3b+XSOuPabCu/YldUx
  • TLSH
    T1BA231B003BE8823AF2BE4FB45CF26145867AE6633603D5492CC451DB5623FC6CA526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2