Extracted

• • Target
    e927bf3a8ea69e6928179b6c31ac9c94756cdcf1a879e92d5d35e7f234835793
  • Size 45KB
  • SHA256 e927bf3a8ea69e6928179b6c31ac9c94756cdcf1a879e92d5d35e7f234835793
  • MD5 0a3edf63e473e0f966c83edd2d0b3463
  • SHA1 990ce3852917186d249187c546a2390412bdaec1
  • SHA512 f542bdad45b093fd9f55fd40e3925a1e5ae6134997b2116f2c726b2ad68e02b91eb4842b665f704b40d4c49a969742797f7aafc1d5f106796281fc8a48221ec6
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9ZRzMwnOPIZzjb8gX3iez0Qjw3LYBDZ8x:0u1YJTHcw2SA+3Z3bTXSK0ped8x
  • TLSH
    T1D9232B0037E8822BF2BE4F78ADF26145867AF6673A03D54A1CC4519B5713FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2