Extracted

• • Target
    a1359674b10e3605cae8e185a4b09df33642033bfb4ef10ad7660688c930cec5
  • Size 45KB
  • SHA256 a1359674b10e3605cae8e185a4b09df33642033bfb4ef10ad7660688c930cec5
  • MD5 f40b5b58edb108aa7437081ada844dd0
  • SHA1 8cce85bb1e5e011cd68827f21d4d3043c32f3841
  • SHA512 1851aa5333a36292e98cd9cb85d18e49afcc26549002c9c1a6287ea737335bb06bcee494e25f3ca6cc66c4a148a89ee99fd2b5ecd524a3f6d41ab03598f89f47
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qACLiE0yFjrdj3kk8PIhsjbtgX3iUn3bypV9XcxKv4:cuqNJTLr62yLBXDBhcb6XSo3bypVlcxv
  • TLSH
    T1D7231A0037E9C12BF2BE4F78ADF26145467AF6736A03D6491C8441DB5723FC68A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2