Extracted

• • Target
    1a29cc13adb1f987bc74d97dcc9bab2a1f47604fc3a47ddf72b8ee572bf697c0
  • Size 45KB
  • SHA256 1a29cc13adb1f987bc74d97dcc9bab2a1f47604fc3a47ddf72b8ee572bf697c0
  • MD5 0f1ad1566d0552135ede57c97c26ba73
  • SHA1 96a4c17e3c8e74bbd2fb5e450eeb6d326e7360d5
  • SHA512 f552594d34c53342c3c708634443387f98d9a5c1bc18ee35fc688026ab70693de506121bfe5005c58d2cfdb73436e0a9336a7e12ed53c1a592478430471ebf46
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtYEQL0Yj/OPIC6zjb6gX3iNbloUTLpOnwsRnBDZ0x:5udApTNmU2VbT3C63btXSNb2qLAfBd0x
  • TLSH
    T1F6232B003BE8812BF2BE4F78ADF26145867AF6637603D5891CC451D74623FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2