Extracted

• • Target
    c1a317d32e58796ef97645b5c1b9eda4988a7d85c4543d43d3b3514354aec64c
  • Size 45KB
  • SHA256 c1a317d32e58796ef97645b5c1b9eda4988a7d85c4543d43d3b3514354aec64c
  • MD5 f7c4ec20ed1db37b876f7aa8be80869c
  • SHA1 32d7765ecd697a986b2a8b5ea8b6dc7377466483
  • SHA512 395f1fc42c3b3a6159d7540b9ab8a28bc2cd67b2de67262b7e6c561fcd9c0d9e26bf8188933c389be97749a254822f52dd4968c2a5d375f8e26545234ba1cb53
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9MCOtTMtPILzjblgX3iZ61jEe6cwjKwBDZ8x:0u1YJTHcw2TRvL3biXSYqcwjjd8x
  • TLSH
    T1FC232B003BE8822BF2BE5F7899F26245867AF5672603D54E1CC441DB5623FC59A02AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2