Extracted

• • Target
    c1e54f352e5e6894069000ad990d664a51d0b8cb1444c238d70ba9f20923aa21
  • Size 45KB
  • SHA256 c1e54f352e5e6894069000ad990d664a51d0b8cb1444c238d70ba9f20923aa21
  • MD5 1ef550ec02099fe89c6fbd9dc0919076
  • SHA1 4dbea9061f826ae2913f0e484db278ccbe161eed
  • SHA512 d364e82718aa3e146368630c64753d5a12b611e52817c9941646f90c0f588d2163a6b6029221f57c6ece6ba3e41beba72409a1b6f458e1f4264576dc318d0db2
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4UITnyfaaPIezjbjgX3iwKdv/DRkUe/dcBDZ0x:8uUIpT4vAj2wEhe3b8XSwM/mUe/d6d0x
  • TLSH
    T182231A0037E9C12BF2BE4FB899F26145467AE5673A03D58A1CC411DB1623FC6CA526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2