Extracted

• • Target
    ff14c4987b3d1ab7eecf002850ac4321d5bcc7afb3bfdef499581f74792086d1
  • Size 45KB
  • SHA256 ff14c4987b3d1ab7eecf002850ac4321d5bcc7afb3bfdef499581f74792086d1
  • MD5 3ce41de6c9c14ae2dd77a917c25a828d
  • SHA1 06f6cb02a8d0a9816917d46a2cd57be31f352d4e
  • SHA512 739622a5c3d1111f899376ed9989f77389119af5162852b896312ef053defbbc1bd28371e1c601ecd21831c3c3c1898aef1d472970bf8af8fc8e159aef788ce9
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9tCSwTMjPIukjb7gX3iMQ6hGhBDZsx:EulCJTHl42ag1ukbEXSMsdsx
  • TLSH
    T1E2231B0037E8C12BF2BE4F7899F261458A7AF6673A03D54D1CC4419B5623FC68A526EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2