Extracted

• • Target
    e585d424b99c8e64dc64b9453a2ec8a09f1c42404c18453d76826f4d491ffd96
  • Size 45KB
  • SHA256 e585d424b99c8e64dc64b9453a2ec8a09f1c42404c18453d76826f4d491ffd96
  • MD5 44a394d59be978c76662575b7f3f6bea
  • SHA1 2ece1565d1cbeb6d92b0c6d9856881998d74eb99
  • SHA512 8a27c00f7a263de2dfe098efc05fcfc6498ad43c498a81bccb3d79dde5d81ae9f7125acada391f61e74f0030ae9f8c32c82f50dec0b629feb8f8ba8c5d8561a3
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFvZTohEaSPIUzjb7gX3i+47q1vcoV0BDZEx:MuLAZTnbg2O4Ea7U3bEXSvq3VCdEx
  • TLSH
    T14F232B003BEC822BF2BE5F78ADF26145467AF2A76603D5492CC401975613FC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2