Extracted

• • Target
    1eadc64bf81e33d7ec6674afc7148b8928861d3c089da9fb014204d1a876492f
  • Size 45KB
  • SHA256 1eadc64bf81e33d7ec6674afc7148b8928861d3c089da9fb014204d1a876492f
  • MD5 e074d65f0526c5b2d48382f7aa5c0624
  • SHA1 8b49416a121ca8e6cf70bb3310c479707e107f0d
  • SHA512 35609c1cdf650820a09be055d1ac4648db33aa320e1cc6cb957c04db8f78600eb5e644a72ae6b918dd2c089c93e0d48aebcdd923fb3ffdb62cc02ff1ad1fbef1
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtXCXtTtSPIVzjbVgX3iB+YUAh08Cme0IBDZ0x:5udApTNmU2gwxV3byXS0YUS0z0ud0x
  • TLSH
    T1D4232B0037E8C12BF2BE5F78ACF25245867AF2673602D5492CC451DB5A23FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2