Extracted

• • Target
    e4349c15db62597e2d483a496044b4cfa061e742ce000acc139b0154e3ab06c5
  • Size 45KB
  • SHA256 e4349c15db62597e2d483a496044b4cfa061e742ce000acc139b0154e3ab06c5
  • MD5 c8bf063c1f45b786bb5c80a00329cdb3
  • SHA1 2d1c2f3e6ef7f93281298628af4f6f61192bbd50
  • SHA512 716aa8d12699330b445c391a77b584bfbfb9f6f90abd30ef02468527d9234ce882cb8159569c47a542988ab09b4cbe824cd06993ff089f76384607ada70e48ef
  • SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7h/rLzlJAOPIc6zjbJgXSibGKFq6AoJqBDZ8x:0ushJTDXgH20Pp23c63bGXbbGVLO0d8x
  • TLSH
    T12A232B003BE8822BF27E4F7499F26145467EF6633603D54A1CC4529B5613FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2