Extracted

• • Target
    1e0521bd35dee774ee65afaa6bf82504cecfbfc96bf2c171bcda3966193fbdca
  • Size 45KB
  • SHA256 1e0521bd35dee774ee65afaa6bf82504cecfbfc96bf2c171bcda3966193fbdca
  • MD5 d894abfdc7b653f735536c3c791bef2b
  • SHA1 4d725eb660364d6a0926fd0bbba5b50fd2205754
  • SHA512 7f07d0f82f7206aaee6f1eaa694eeaa296cbcfd03438163bb7571ee89e72304bbaf29358a5d9497acea2a6efae65cfcbb6182854818f97c024e3f851d62c1ab2
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q140b3NEAteiZPISzjbegr3iSDnkcwwpypEuBDZMx:wuZ8pT1tc2y3ehiWS3bhrS/claEgdMx
  • TLSH
    T11C231B003BE9812BF2BE4F74A8F26145867AF1673603D5491CC451DB5B23FC69A43AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2