Extracted

• • Target
    e86c3eb04a7666574b3c304acc7647ff9ad393b0f49af33fcf7e0e668d3e47da
  • Size 45KB
  • SHA256 e86c3eb04a7666574b3c304acc7647ff9ad393b0f49af33fcf7e0e668d3e47da
  • MD5 c9c3e83f38fac974454c00245b956be7
  • SHA1 df0932281c43e95510024825150e3b3d41e65e80
  • SHA512 9c5f6fdd0f5543abd4c1b8df133f802f0e6df2e3d374b9674062f597ff8a8e20b311e19f7e9c0620d540bf5fc805c8e175184de5eeeac528dc91788bb5a734c7
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAh8V1QpfEcPIYzjbGgX3iIGDjI8e+zx/1ilPBDZMx:kuSOpTPOP2x8ViBEhY3bZXSIGwJwtilW
  • TLSH
    T110233B003BE9C22BF2BE5F7898F26245467AF2632603D5891CC451DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2