Extracted

• • Target
    1812f6d41b873e401751cb85558ee8b6d11274ae82aff7b0b828a21b59fc888b
  • Size 45KB
  • SHA256 1812f6d41b873e401751cb85558ee8b6d11274ae82aff7b0b828a21b59fc888b
  • MD5 8104a306680059c61113e80d27aa8b02
  • SHA1 6a7dda6c48b546cd84f3f390d80b411cd800313d
  • SHA512 51b5d271989e8c2ba8f56b8a5f802306d1d5a540fb76f901f41e104d7bc49f0c67088ddc431e1665ce7e0d4481d65a24f8619f0e05a4be48085e0aa9d3b630e0
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9OoopCBK9INJPIZzjbAgX3i+q50sHn3VYNBDZsx:EufspTf2g2bo6bIwZ3bnXS+Mngdsx
  • TLSH
    T150232B003BE8C12BF2BE4F7898F26145867EF6636603D54A2CC451DB5613FC69642AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2