Extracted

• • Target
    c1838fe2aaddb4b5ec8b78b4ec211fb8974a51cccff241b7174b2844abd01906
  • Size 45KB
  • SHA256 c1838fe2aaddb4b5ec8b78b4ec211fb8974a51cccff241b7174b2844abd01906
  • MD5 e665dc56b5b5fff45c496bd0328d36da
  • SHA1 ac42e791cb5d55e68235b29fb7dae01fc2bf3d42
  • SHA512 1ae20f631b7bc1e20a789c10ad2d538e377826e7800947a7bfc6ea4695337d133cccaf1ecf6a187999c5ec1cb4d006860aabb3a6ac879cc06324b216cd332ab8
  • SSDEEP 768:rukO5TkI7ZzWUTZ9Fmo2qT33Fo9EaOPIczjbNgX3iFMBuc4/24Ck1Zx+l71BDZ0x:rukO5TkUH2s8Ea3c3baXSFMYB/31Zxa8
  • TLSH
    T162231B003BE9822BF1BE4F789DF26145867AE5632603D54E2CC442D75713FC69A42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2