Extracted

• • Target
    eb3a8e0c465cbfdca0958a851ef69e021f80e1fb367ca5b88b8c0dbbfd672c4b
  • Size 45KB
  • SHA256 eb3a8e0c465cbfdca0958a851ef69e021f80e1fb367ca5b88b8c0dbbfd672c4b
  • MD5 40cd5ada8e31773bf728116d53719aa5
  • SHA1 80fa4516743960779d04338429999a8ea4fd9a62
  • SHA512 07393350cd8b51dc868d908872e5838912e015086ba1eff79fc43147726ac1f1c4550a60965ca238deadd4a02e77d14cba9c35e15a536c0fa4b00c3c54021b7d
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFkhk6K7OOPIzzjb0gX3iehpxHdLRpVlxJMGbaBDZEx:MuLAZTnbg216VO3z3bbXSePHRRxnbEdG
  • TLSH
    T1B6232A003BE8812BF2BE5F78ACF26145867AF6736603D6491CC451DB4613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2