Extracted

• • Target
    ea69bf522b68e12de834d8ad98e7a1a98bdf518f9b838733a72a8309f8a60443
  • Size 45KB
  • SHA256 ea69bf522b68e12de834d8ad98e7a1a98bdf518f9b838733a72a8309f8a60443
  • MD5 a1fe873e3d6cd7a53371bccec75fb61c
  • SHA1 e52e516c2279d658b1ea4a6ad8f669f9bffdd487
  • SHA512 55a62cc8138d6b44edaa7d4c02d695afbd588bdd2d7ff768ae14fa7163fcb7b839307d8752495f6a5d0af72c0a56edbf104a4cb752a4f520f07e74af46d06ee5
  • SSDEEP 768:4uBGJTP0BQ0UWUWHaimo2qVzsD/pneqPIkzjbFgX3iXUijlKdzId7BDZ4x:4uBGJTPho2QsjJeTk3bCXS/+zytd4x
  • TLSH
    T168232B003BE9812BF2BE4F78ACF26145867AF6773603D54A1CC4419B5613FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2