Extracted

• • Target
    1e5f1928f33bace99321d6d3870772d53e2581e57ae24f4938c13887f652845c
  • Size 45KB
  • SHA256 1e5f1928f33bace99321d6d3870772d53e2581e57ae24f4938c13887f652845c
  • MD5 4fc9361e1ea61578def7bcd85d6e4210
  • SHA1 308df7acb2d1737cddff7eb7e826a7875cb9cb52
  • SHA512 e3fcfca1e15b62aa6e6466ae4c093ce4f29ead7b69dc51630ae057497fd2dfd55874805e9ddac2ff3a7c9761aa6cca1c602d5e03ff03cbf9ed0b7d43924e3443
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9jZoQTMtPI4Qjb9gX3iUDbSabn7wBDZ8x:0u1YJTHcw28L34YbqXSUDb3ed8x
  • TLSH
    T151231B1037E8822BF2BE5F78ACF26145867AF2673603D58A1CC451DB5613FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2