Extracted

• • Target
    ea84491844d1525be3dc67cbea0f3ad06163ac1a6c0fd288a4ae9daeee3aaf6f
  • Size 45KB
  • SHA256 ea84491844d1525be3dc67cbea0f3ad06163ac1a6c0fd288a4ae9daeee3aaf6f
  • MD5 914d9e364b50ff3339abe4b7179333a0
  • SHA1 b0164d91fa16c2b6db29962ae4588d705c289463
  • SHA512 02801abf224fd5f80b059f061f1f2a74d193e7405c249d33f3dd0024f43e97a8cb91737a839355648705ef850d771b8479c667bb3277f659755d8a855d2e7f4e
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9zzjHy/aKPIbYjbtgX3iMMGZ5nBDZ8x:0uPrpT/qY2QnhbQb6XSMVBd8x
  • TLSH
    T12D232A003BE9C12BF2BE4F789DF26145857AF6633A03D6491CC411DB5713BC68A52AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2