Extracted

• • Target
    b1b591fee3541b17ad2899ef330f8b5fc08e7d78622b29658e3bd696006923f3
  • Size 45KB
  • SHA256 b1b591fee3541b17ad2899ef330f8b5fc08e7d78622b29658e3bd696006923f3
  • MD5 cfcf46f920fa89ace7c2dfe1a774baae
  • SHA1 a759ea367337841eab01543e3e7392e6722d3460
  • SHA512 6f611e2f5e5ad1c890c91377f7d5ad5fec2e376d82999c92e9ca351c468b77b8e31f31cdaec72e59c3fa4cf5a625421fca1eb3d53f71162ff463a385c5ce99ea
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9aCSwTMSPI51jbQgX3iCnnAyJH70dWXy/BDZ8x:0u1YJTHcw2NgG5dbXXSonXJH4dWiJd8x
  • TLSH
    T1D0231B0037E8822BF1BE5F7899F26145867AF6673603D58E1CC401DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2