Extracted

• • Target
    1ef883e415a043c8560bcddf330505d048956c279453bd88d856db4566dbad9b
  • Size 45KB
  • SHA256 1ef883e415a043c8560bcddf330505d048956c279453bd88d856db4566dbad9b
  • MD5 78e081fe3705a1fee1f115d5b494271f
  • SHA1 8195749308c08c429ce356a82fe127c6c7095ab4
  • SHA512 8b36b1485d2650f5319f9b3e9b7a55739d6cfd67029c5d7fa24c5461db6c0147b9e7f69de6b0709a433f7b61f09db423244b8121d121ba67b5cb76e0cadc61a0
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFOeeXKGoibbb6tN8/nPI6DzjbpgX3i/wuA6Ppo64ihl:MuLAZTnbg2aeDqtNKA6D3bmXS/wuTPQE
  • TLSH
    T1DD231A003BE8C12BF2BE4FB86DF26145867AF2636603D64E1CC4519B5613BC6CA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2