Extracted

• • Target
    c10e2827e1110ac7b40ee07ff9c982f2c21289a20f2951427e16e86cef42e408
  • Size 45KB
  • SHA256 c10e2827e1110ac7b40ee07ff9c982f2c21289a20f2951427e16e86cef42e408
  • MD5 41851406bc25bbd35c9e4d31e70a4fa1
  • SHA1 bffdf17f1aaabdee7f69f55f6a1ff4b608d6e6da
  • SHA512 e99df358f815d04111bd797033bb7a4ebba11e65a52f7b3bccec8a806bdf506fbdd8847da84bf2eead3ba706b1fb0e611189394ceb08e5318527137af7ef3131
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYDrE7HLCjJOPIImzjbZgX33TYEOVIBDZ0x:8uuSpTgyf2bSWN3Im3b2XHAVud0x
  • TLSH
    T124231B003BE9C12BF2BF4FB899F26145867AF6633603D54D1CC4419B5613FC69A42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2