Extracted

• • Target
    ce523d1edaf2f9cd0889d7a072504d88611d8ab13ab36ed9f14221a938ee9010
  • Size 45KB
  • SHA256 ce523d1edaf2f9cd0889d7a072504d88611d8ab13ab36ed9f14221a938ee9010
  • MD5 278e563c3a76d0b591d13cef27257300
  • SHA1 abccc5cdd7b778aacb027c9df6cb60b000b4824e
  • SHA512 11dd3eaf6e931e1bce7ec5ed099e066a812f1f0f2f63d1a40226177f8f1d40628fe5149c53acabb9dcb246240d8c8af02051d99ad421c390825b9d5ed50ea3f3
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9sZo3TMtPIQMjbrgX3ijWOjAeDVZwtuYBDZ8x:0u1YJTHcw2dU3Q8bUXSjTVZ4d8x
  • TLSH
    T1A0232B0037E8812BF2BE4F78A9F26145867BF6672603D58E1CC441DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2