Extracted

• • Target
    c1415f44932f02c7ac30324b094bd114b6de7611286cbb081eacbab7f8d3bb27
  • Size 45KB
  • SHA256 c1415f44932f02c7ac30324b094bd114b6de7611286cbb081eacbab7f8d3bb27
  • MD5 65347df9bd8c588237ed7295fae9ea9b
  • SHA1 d495ca148dcd6110fd522dc4f6fb97baee095b93
  • SHA512 a3325f5ec40740fe9e3e4808fa95c352d3cc7fa395fa5040c7567b226e936525d28466034740c784f0aca90f66cf8dca48a4179139faada13fe115a34a29ca32
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9HQ6vincPI92jbZgX3iYgCW9Lodww+/xBDZ8x:0uPrpT/qY2BKU96b2XSrodww0d8x
  • TLSH
    T1AD233C003BE9C12BF2BE5F789DF26145467AE6633A03D6891CC411DB5713BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2