Extracted

• • Target
    1ad909c5f2ae4d13943512cc8670fbe9d17ffd6bc022ceb59e33221e8ecee69b
  • Size 45KB
  • SHA256 1ad909c5f2ae4d13943512cc8670fbe9d17ffd6bc022ceb59e33221e8ecee69b
  • MD5 cd331612b782dbb7c9ad6ac3baa69fd7
  • SHA1 0406e00daccdc693fc0cd704deec69ef8e6e9208
  • SHA512 87877523dd4d5dbfffe827723910fabd2dabe25b3ce126342895aed6a1f6c37f63a8c20ff9f234c04ffcd3f19635ec3539666d312fe11c257659d16436c4585f
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9nDEbHBqj2OPI/pzjbbgX3ibxEZWERBIjBDZsx:EulCJTHl42IyoK3/p3bkXS1cXIldsx
  • TLSH
    T1DF230A003BE8C22BF2BE4F78A9F26145467AF6633603E54D1CC451975623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2