Extracted

• • Target
    1c226848b034b0bcc285bd18c9d80a30f53e6fc5e2857051ca8e0562bfa313e6
  • Size 45KB
  • SHA256 1c226848b034b0bcc285bd18c9d80a30f53e6fc5e2857051ca8e0562bfa313e6
  • MD5 f4f2459a3608343002b4afe1cd71faa5
  • SHA1 8e28c8401ba0d2f1447c3de3d03403b55aaf3205
  • SHA512 e4d09df2e4fa2785feef8307241b8a5076f3f1e2ba54646a95f10e7315682165abec6c1eec4ef84524650cf2caabedfb7e79114a2d4f2e3d1bdde1e94dbaa5bd
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4wOJQICBIvSNjPIfzjbngX3jVmoifMqafYEzSqBD:8uUIpT4vAj2kOJD3SKf3bgXzKfhse0d2
  • TLSH
    T1852319003BE8812BF2BE5F7868F26145867AF6633603E54E2CC451DB5613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2