Extracted

• • Target
    01871a9d86cdcad1e941ddb540d66ddfc809d17dc11d55f684bc567d3154dcdb
  • Size 45KB
  • SHA256 01871a9d86cdcad1e941ddb540d66ddfc809d17dc11d55f684bc567d3154dcdb
  • MD5 bdd160554bfc9372a870ff58d67fdc74
  • SHA1 0d986b1033e264da65e60c4524a1b4d6b3a25829
  • SHA512 7d9d8193e41d0ca15c5de59a67d09928a580c901eef9c8618047709b43d2374a206ca8b95374759aebdf95c27cb8b70e943f84904bd5db00e4c361ccdc80137f
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1exGQG9PHuPIczjb2gZ3i6pc7xsyer9XwBDZUx:cu6YepTPso27HC3c3bpZS6pc7xs3VmdW
  • TLSH
    T101231A003BD8812BF2BE4FB899F26145867AF6637603D64D2CC441DB5723BC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2