Extracted

• • Target
    15cc6ce1825e00f547c0c9260a2bc39f21717a97503ccbbf87ae6367dfb43f97
  • Size 45KB
  • SHA256 15cc6ce1825e00f547c0c9260a2bc39f21717a97503ccbbf87ae6367dfb43f97
  • MD5 b653bd24ec5b09412032ca6cd43b1ac3
  • SHA1 ba2276612d6826fdc98ae0cb5e7793c9c68e5440
  • SHA512 44a35e6fa3e42e5bcf6e493afb106895f68914e10ffca5ce25c4fa4c0b33208e96754591085091d2e38ed6025fd6223b82b5b72be47102a034480ac7c62d4b77
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9aCSwTMSPI52jbHgX3iNJgPj1HBBDZ8x:0u1YJTHcw2NgG56bAXSMb1fd8x
  • TLSH
    T108232A0037E9812BF2BE4F78ADF26145867AF2673603D5992CC441DB4713FC68A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2