Extracted

• • Target
    1e4d2bfb39184fd429a1ed83b596b3754276655cb71bf86f8e4a8b07b6a4d42b
  • Size 45KB
  • SHA256 1e4d2bfb39184fd429a1ed83b596b3754276655cb71bf86f8e4a8b07b6a4d42b
  • MD5 d7b1abb92f11a8c91743294117b31293
  • SHA1 cefae035977f43fa0df36030793f0bd66d5400ac
  • SHA512 ef7e35b3b059148d28bb9d62c5b044e626c7b8e89c79553b7e73c267a87052634d7c14ef60e9ef9abf7448166decb5259422dab7d2460209433bdcdafcd75b45
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtLZo3TMtPIehjbugX3iA/FMyLD36V3NBDZ0x:5udApTNmU2UU3exbRXSA/lLT6td0x
  • TLSH
    T1EF232A0037E9812BE2BE4F78A9F26145867AF2633603D54D2CC441DB5623FC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2