Extracted

• • Target
    1e6f57934ccbc6005c699f59226c540ec6998369298c960563b2abd4b9060de8
  • Size 45KB
  • SHA256 1e6f57934ccbc6005c699f59226c540ec6998369298c960563b2abd4b9060de8
  • MD5 a1074aade816120512776f858acd9316
  • SHA1 092c84fc274d06bdac65df056e2db033536f2bd4
  • SHA512 178066aee4d1fc119abaed1fff3142a99cc2c209ea550b85579ac95963a6c7848bb07a255a44e816104f16d457e56c2e47433274576b4126aacf5ebf1ab18861
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1V8V1RpPEcPIMzjb4gX3iCC2ElxZMTM4FFNsr2Fr3u:wuZ8pT1tc2W8VDZEhM3bvXSV28MtHrx8
  • TLSH
    T139232B0037E8823BF2BE4F7898F26145867AF1677603D64A1CC451DB5623FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2