Extracted

• • Target
    1e4f653962fef025e6a9987705ba61f4c8f48da018baa863c6ea9f6c5b0eb7c3
  • Size 45KB
  • SHA256 1e4f653962fef025e6a9987705ba61f4c8f48da018baa863c6ea9f6c5b0eb7c3
  • MD5 ade03ff0f0062422807b47c11d342065
  • SHA1 cbb35c4914e94531863250a7c6bb5608a956b660
  • SHA512 4e97f36e8d7a1d964738084ec2421f92a58b783b517309569b319f64c46dda3e23ec116b9c4bc43b21571c10c4c9cc40f23772640792cf90aadd9f8be8c34416
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9TZoyTM4PIX1jbEgX3i21NrBU8/P0BDZsx:EulCJTHl42sh0XdbLXS2jBU8/PCdsx
  • TLSH
    T12C232A003BE8C12BF2BE4F78A9F26145867AF6672603D54E1CC451DA4723FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2