Extracted

• • Target
    1b0c9b8d606c5d318a05bd7cf625d68c1a3150be48a8e1b6ebddfbb35243c35f
  • Size 45KB
  • SHA256 1b0c9b8d606c5d318a05bd7cf625d68c1a3150be48a8e1b6ebddfbb35243c35f
  • MD5 fb9b1442fee89b02ef416312c566b481
  • SHA1 2d0eeaaf9203d1ee4d1af8867b887d6b63274e96
  • SHA512 530c5b2c577d05ba540450bc8c850d78c258f75ba56fee82689b359d36f9eae8e191de74715464c0245bd699ee2e9316d6706a00d30daf5b98f05ddde6a2b429
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtbx1HJhOPIcozjbjgi3iqUrAEDQicBDZ0x:5udApTNmU2cFj3co3b8iSqUUSQi6d0x
  • TLSH
    T14A233C003BE9812BF2BE4F7898F26145867AF2673603D58E1CC441DB5613FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2