Extracted

• • Target
    1ec955b719fdc3318a54da92d61e4fe8dfbcd2f2f08ed04c240f5cb4e9493d3a
  • Size 45KB
  • SHA256 1ec955b719fdc3318a54da92d61e4fe8dfbcd2f2f08ed04c240f5cb4e9493d3a
  • MD5 c9b85efe35431938b0faf4a0fccc34ba
  • SHA1 a1db2741e18518c11b184a39320347d8c6699b17
  • SHA512 a51a64bc848920c3f3971249ff38022d5e0bfe8ef9c7d02662f8c5cfb40209d8de4c73eed4f2d42fc8f374a51c5ab5fa251029360e50eac496dddb71d007b87f
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1S4ovHpU1cPIyzjbwgX3iTok4+5OIEq/rBDZUx:cuR0JTPjY2J4ofC1hy3b3XSToj+BzdUx
  • TLSH
    T111231B0037E8852BF2BE4F786DF26185867AF2632603D6491CC4519B5613FC6CA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2