Extracted

• • Target
    1ed04103aed225e61549085e9ee047eb70095ec65456029801a37aad5ed90284
  • Size 45KB
  • SHA256 1ed04103aed225e61549085e9ee047eb70095ec65456029801a37aad5ed90284
  • MD5 6783cfd16c8c2d24170d4974340b6c36
  • SHA1 089b3d86fadabdf1e269b8b628dc2fe0ba417cda
  • SHA512 0abcba8e6b5e8584c3428cbec3a6d91f3b86658ae7d0fb2a4aeee7a9d19be739eeac89a774d5b499e91a1d3893caf5d0226ee817f3537da8d15220c8b764797a
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAfmaPylF3APIFzjbwgX3iggqACETL2fynFBDZcx:UuKWgSJTwRf2vfyv3lF3b3XSO4wynLde
  • TLSH
    T153233B003BE8C12AF2BE4F78A9F25145827AF6677603D64A1CC451DB5723FC2CA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2