Extracted

• • Target
    18a2846ac5ca8cf15e108d964badce95faf3b43c36a84121eab8c99c1222d17c
  • Size 45KB
  • SHA256 18a2846ac5ca8cf15e108d964badce95faf3b43c36a84121eab8c99c1222d17c
  • MD5 9a871e4c0c4dccffac1c8caaab23384a
  • SHA1 5c57c4ab7401eec42e74ae9c0908dd265af6e9f6
  • SHA512 f28216716bee361c53c18e61134b4d525d7142e58c09852136641cef3ac4da20bdc8a7de14adb8fece768695519e94ca29f2e09972d2e92cda5d094bdc0d9214
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2ql43Fo9EaOPI7zjbmgX3iuJcxDExG6dVj12BDZMx:wuDWZTpMZSB2J8Ea373b5XS+cickVjO8
  • TLSH
    T1FF232B003FE8822BF2BE4F78ACF26145857AF5A37603D64D1CC451975613FC69A42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2