Extracted

• • Target
    1ce400ba16bda68cc04fa27de5db68ff1d291fd217b0e176ed8c180545ab147d
  • Size 45KB
  • SHA256 1ce400ba16bda68cc04fa27de5db68ff1d291fd217b0e176ed8c180545ab147d
  • MD5 e10687248bd9541d1446c723350f57e5
  • SHA1 270feab2026df3a866467a456e842083e4a354ae
  • SHA512 67ac2b716e2192c5a890fabaff2ffe80790665a8385e7c5d433499a51a14af6af8acbd5182c5a69132c9e136732a047edd6c6be04130cb944133a4bd903f1703
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1IBz3QKx7PIUrjbygX3i6dhn6rNIUYzqBDZUx:cu6YepTPso2NV0U/b1XS06aUYodUx
  • TLSH
    T1EE232B003BE8863BF2BE5BB86CF26105867AF5633603D54D6CC451D75723BC68A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2