Extracted

• • Target
    1a3ecb541cbcfdc6a43bb9b821e2c533ccde1bd21398a324cb4d792d4370d65b
  • Size 45KB
  • SHA256 1a3ecb541cbcfdc6a43bb9b821e2c533ccde1bd21398a324cb4d792d4370d65b
  • MD5 48911a7fd03d2b0f905b612ff115934f
  • SHA1 622e69d8fc8fa398eb1c1ee09a3c992433e7ad51
  • SHA512 df5bbe95a6371884b8c93e946b7ccb7fd12937226b85c58483c3935d50baf48705544b2cb9f5188866844a07021d2b4ef2e9e4559b7ecfc32657538a6ca2c7c9
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9zzjHy/aKPIbCjbrgX3iRDgopifA8Bkt3vBDZ8x:0uPrpT/qY2QnhbObUXSlxioptpd8x
  • TLSH
    T107232A0037E9C12BF2BE4F78ADF26145457AE6637A03D6491CC4129B5713FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2