Extracted

• • Target
    1c61bb8c449c2f4f6f852acf8814aec5b8a4ee328936fde453379b2608913fec
  • Size 45KB
  • SHA256 1c61bb8c449c2f4f6f852acf8814aec5b8a4ee328936fde453379b2608913fec
  • MD5 fe9b13e4b92c736bb8fe51eb29bdb5af
  • SHA1 f2d6b1054cb24533f4bf6162e1340d859bb07365
  • SHA512 c6213abf95270b5226c035013f4b7ddcdf0537fc83402be17f8d248cfee53cf3152c15228f9c0bc42ac1e4841dc714605eb38f61dfad8822fbd4c3ada35f2e68
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFgAuXueMY958vnPIMzzjbcgX3eeDMQDmytpXbQxiSZ:MuLAZTnbg2muzp95iAMz3bzXONybLciL
  • TLSH
    T195232B003BE8812BF2BE4FB8ADF26145467AF6733603D64A1CC4519B5613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2