Extracted

• • Target
    1d8c0a7a07ab3bc0906165f6b1464b4d533dba680783e50653257efd79005c7a
  • Size 45KB
  • SHA256 1d8c0a7a07ab3bc0906165f6b1464b4d533dba680783e50653257efd79005c7a
  • MD5 6345509fadc27a4980cb4219bfb5bea2
  • SHA1 b37d0817f442f9b8c0a8a438380173fef08c2294
  • SHA512 d414c79b14780244071371af77f63182a6db22089a361127ac8f5be53bd308ac383939ad0e80f9d650dad0f3d295272048a41fa3a0ba710569074a146b9fb076
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjMzjHy/aKPIb7jbkgX3iNszSpKJi+ONBDZ8x:0u2vpTDe+2FnhbvbrXSNkxwDd8x
  • TLSH
    T142233B003BE9C12BF2BE5F789DF22105467AF6632A03D58D1CC011DB5713BC68A526FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2