Extracted

• • Target
    c1ef4404b3214fbfe8d7a0b5c5406e4341a86b79eac5edee650ab437a5d45871
  • Size 45KB
  • SHA256 c1ef4404b3214fbfe8d7a0b5c5406e4341a86b79eac5edee650ab437a5d45871
  • MD5 7e52da6d599a29d17cdaaf9f32093145
  • SHA1 46291b6ebb88c23d3b9aa717a0982cbca95e5982
  • SHA512 6ff887e23a09cf1a3761225b4732108b6ec3670d206a3c7c0de741df90f2ee2c95e5d213cda9c9d51b4808773d9a31fc08dd8347216bf58805b1894f924ba601
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1sqwZQaKkPImzjb9gX3itjGTrSUfyUPBDZUx:cu6YepTPso2LIm3bqXSt0rS6X5dUx
  • TLSH
    T1C3230A003BE8C236F27E4FB898F26145467AF6672603D6492CC452DB5713FC68A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2