Extracted

• • Target
    1c616a8c06d7fe7ac163086966a134f2a5253bad869db1e7f5ec87e6e7bd70f5
  • Size 45KB
  • SHA256 1c616a8c06d7fe7ac163086966a134f2a5253bad869db1e7f5ec87e6e7bd70f5
  • MD5 9c3133cd7aa9ea43ffc8eccf00dfa116
  • SHA1 c081feb84e99526dc449eaf908f1447d9f03a834
  • SHA512 54d067fe38e5bc18a26ea1d17bfbfdd3463aab97ac99e403a29a6aa2edf673d69f126aa9259ed3b160d903dcb13c8ab1d4fda5cfe3726f1ea97a71da2af4653b
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1xGju8eQlZwZPI5zjb+gXVi4QYBuOHYh6BDZMx:wuZ8pT1tc2kGjuVGwW53bBXE4QKuOrdO
  • TLSH
    T1E2234C0037E9C12BF2BE4F7898F26145867AF6636603D58E1CC441DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2