Extracted

• • Target
    1a47e0dd2e9024d428a7edcc0eb0963fcb0edce801c8587108caabf7caf8eeca
  • Size 45KB
  • SHA256 1a47e0dd2e9024d428a7edcc0eb0963fcb0edce801c8587108caabf7caf8eeca
  • MD5 2baf502e1b8c31aaa222f9f707099063
  • SHA1 ff15084741222b47501511e2630da1136be07a5e
  • SHA512 c4542052598d17df82e630e7f40bbd3446da47e80961cf2f4e34ef69ad68ed7810f966dee0253f4cf7d1c452f1b97dfa567a07d59ff030cebdb2b10c7e2f086b
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1LT2Qpm7PIKjjbegX3iYQ8p7LRLhEFBDZUx:cu6YepTPso2JeKHbhXSX8/udUx
  • TLSH
    T187231B003BE8823BF2BE4FB899F25145867AF5633603D54D2CC451DB5623FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2