Extracted

• • Target
    0c1104b1fb365efa7be5f0c0830f454e063eff7885209fd189517d7cf921daa1
  • Size 45KB
  • SHA256 0c1104b1fb365efa7be5f0c0830f454e063eff7885209fd189517d7cf921daa1
  • MD5 9d6002e99559e040e4b199acb4e5eaac
  • SHA1 bf3f89fe24a9b712f0fcd61087d37b9b1ff9b41c
  • SHA512 935e5e297c95a82b7d78dc21118764d02e5689bb18f2560a44663f82119b0dc85e8c78bd989f81541d65b25d6ed3fa453c48041ea49b573cf0b1cf1d74984704
  • SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7dCSwTMjPIuVjbEgX3i3FaaonIEYBDZ8x:0ushJTDXgH2og1u9bLXS3FfoIDd8x
  • TLSH
    T13D231B003BE8822BF1BE4F74A8F26145467AF5637A03D54A1CC4419B5723FC69A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2