Extracted

• • Target
    a1c2a9eebce740a83b3c6843532dead257d84c8bc088fb9ccd4255382c3f5bcd
  • Size 45KB
  • SHA256 a1c2a9eebce740a83b3c6843532dead257d84c8bc088fb9ccd4255382c3f5bcd
  • MD5 36a1110ab27b8fc651f6ec83d27b47a0
  • SHA1 b197508210bc88f5bd5ba4d8588168c8a6b35636
  • SHA512 1ab9205b300f8a6a9d90157bf35f3258ee74ff61d90243e1c6575629c12ca39bb5e1704875ad8d71f0c8a84c059fab01b788845da27ee57470e26ff83861b402
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9tCSwTMSPI5Djb6gX3iSS6kuLoaqCC1ql1SLTBDZsx:EulCJTHl42agG5nbtXSSSCUaYv1dsx
  • TLSH
    T1C1232B0037E9C12BF2BE5B78A9F25105867AF6673603D55E2CC4019B5723FC28642AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2