Extracted

• • Target
    d1ecf3e45c341f1cc453d5a92502c4c3e59ccf5b6ed65f9ffd87e156ff08e99d
  • Size 45KB
  • SHA256 d1ecf3e45c341f1cc453d5a92502c4c3e59ccf5b6ed65f9ffd87e156ff08e99d
  • MD5 b9fcd212a39f26c8d1b4e5fa7eda127b
  • SHA1 689f15dac3941383ee90953b73195c84ce350bd0
  • SHA512 32cbfaf359f43f845b84dbdba7d447f1a9dc796826a17f7f49ee992b44e50de073b31696022133290a056c2ee3809894bc0b10dc4f4aa9c995c8ab0b9faf9aa4
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFHBlte40WMOPI0IzjbogX/iD91tPqmzBwa7BDZEx:MuLAZTnbg202UM30I3b/X6RHqGTdEx
  • TLSH
    T1A5232C003BE88127F2BE4F78ACF26145867AF6632603D94E1CC4519B4723FC696526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2