Extracted

• • Target
    e961f44d30e803ac2abeef65c27207f7d62dfeecf3c7b563b047bab65f4c46bd
  • Size 45KB
  • SHA256 e961f44d30e803ac2abeef65c27207f7d62dfeecf3c7b563b047bab65f4c46bd
  • MD5 acbb93dd3d4ae38f8b5fffef731cf873
  • SHA1 f73d285a9ff2eff51d78706b357732b9f60f3972
  • SHA512 b8db96f4139f740298220dc2a5ee4011c06739ab58a69076f5372e1c758e83ec8e2fc5ac564aebfb13896b140d9e2369d4eba92d8b89f6fc995d45cf48b5bc76
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwg3xY6AZOOPILzjbYg73ileawGkXBDZMx:ku40ZTXEb2culO3L3bP7SlTjWdMx
  • TLSH
    T1B3233B003BE8C22BF2BE4F7898F26145867AF6776603D54D2CC451DB4613BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2