Extracted

• • Target
    1ed190592c9c763761afbab4fbc1e4d92ae3526a6b321ca0c9cead10716c2a9c
  • Size 45KB
  • SHA256 1ed190592c9c763761afbab4fbc1e4d92ae3526a6b321ca0c9cead10716c2a9c
  • MD5 2a19b2292708d1099adcf9bd45f2348d
  • SHA1 a95df7da1af5225253d63e6a1da8eb870fe4b2ce
  • SHA512 b409419d39058bab0d2e18412432ca71ad61a83c8a9d64c850a716078b7b24e52d0b1e3e5a8745453760d85e8fd6ee67eb3a93be1b7f93507bb2df15b064d314
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlneeXKGoibbb6tN8/nPI6DzjbpgX3ibf4dXACKm7:wuDWZTpMZSB2DeDqtNKA6D3bmXSstACZ
  • TLSH
    T1DD231A003BE8822BF2BE4F7499F26245867AF2733603D55A1CC451DB5713FC69A42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2