Extracted

• • Target
    a1866e9d75b2f4ec55e19c854e0420a7fdbdf66850e83d1e06505767b9670629
  • Size 45KB
  • SHA256 a1866e9d75b2f4ec55e19c854e0420a7fdbdf66850e83d1e06505767b9670629
  • MD5 3ff8647e3bfb766da4f435a0dc217652
  • SHA1 2558030d4b190defdb176e085551a8c2bc4d66c1
  • SHA512 e6d3abf7b97b7d93774f3ec56ae584d22ce4ad8f7c954550fe4efe4df8fc4ec11a40d0a0882b623cc926b8fb9cf44e749ae812959fea999ee41f9fdf98ed258d
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF7SAFcKoabbb4ZhM/RPIAEzjbsgX3iCS04f1Ig8Gf8:cu7e5TH2A2QSAvQZh6OAE3bjXSCr4drU
  • TLSH
    T194231B003BE9812BF2BF4FB8A9F26145867AF2633603D54E1CC4519B5613FC6DA429ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2