Extracted

• • Target
    1c262c288aa17c2e388199577aaddd17c3103c1cd7e3ffb6a5c23b378857d7ea
  • Size 45KB
  • SHA256 1c262c288aa17c2e388199577aaddd17c3103c1cd7e3ffb6a5c23b378857d7ea
  • MD5 09c324fac5b0667c7db66022dcb242e3
  • SHA1 774c74787d095a92e5885203dd04469a7a7ee527
  • SHA512 136d42905088e360214837ec66d63200306dc9faf2b486ccf0628d883b77ec29e726ffb2f7568b06d83ffe4b6f6795fb21b4b182206456d6fb1e3d70bf198cd9
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNrwD/y/aqPI9zjb6gX3iWlIZzDCW6EGhxAPBDZ0x:5uSy6pTpoo2okh93btXSWl+Cthxmd0x
  • TLSH
    T11A231A0037E9C12BF2BE4F7899F26145867AF5633A03D64E1CC4119B5713BC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2