Extracted

• • Target
    1e4181e0da32f9cf68306dd3cd7a209835a6358994ae525c89d36981ff697ec4
  • Size 45KB
  • SHA256 1e4181e0da32f9cf68306dd3cd7a209835a6358994ae525c89d36981ff697ec4
  • MD5 c8b1c3633c9dd08267400d14280769d5
  • SHA1 13a0f2cd4072816fd66b7aff938971c7bcf6e5f7
  • SHA512 e0ab27d5ca73d8320e2f21fa1bf8b317ae174b2c7bbdea011a9c36bc44ba28460e924cbb1a40cb5d70727a9d1962b2caf7e02fc393000d8e6dcf77d42ed8cf18
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9nDEbHBqjSOPI/XzzjbNgX3ik+Nvv6hXtamYldheBd3:EulCJTHl42IyoO3/Xz3baXSkOIXtjYl4
  • TLSH
    T1F5230A003BE8C12BF2BE4F78A9F26145467AF6633603E58D1CC4519B5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2