Extracted

• • Target
    1e4d709148eb37dc47e0d56d950c7c21a19b0b4f8ebb82b1b3df41d44b8b4e9e
  • Size 45KB
  • SHA256 1e4d709148eb37dc47e0d56d950c7c21a19b0b4f8ebb82b1b3df41d44b8b4e9e
  • MD5 4c8e90d257656c9ebd477f35c2498323
  • SHA1 556b746a9a71c2aab3ba8cdbd67bd1966306938f
  • SHA512 30566200e0c5f79ed0987423c15a29de7ac3cc1f3f6ef49a7b6259bd43cecd348398b4b9df70ca8800b8f05630e6ff1c9fa423dc765b79d2462242b1a6cc9eb0
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9rZbtDMQPI8sjbPgX3ifBa/uonBMiIoUxLWAdQZBD4:0u1YJTHcw2EJk8cb4XSfkGwBMjoUxay5
  • TLSH
    T11A231B0037E8812BF2BE4F78ADF26145867AF6673603D64A1CC451DB5613FC686426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2