Extracted

• • Target
    1fb8d4766fd282bfcc0fb4ba7c80d73581d57395758ac45f795947ec25fced8f
  • Size 45KB
  • SHA256 1fb8d4766fd282bfcc0fb4ba7c80d73581d57395758ac45f795947ec25fced8f
  • MD5 14c4817952d540502044b21021bb22f3
  • SHA1 6497e232942acea5fc94aa38ae08fc5eade52326
  • SHA512 3cd2dd4b8e612ab2d1850437ab7204584cf9f9e76624fdf3646e6838f74a399766506e93c4e855ad47abb2bd3cc9e91f6d5a3b0ede4d0b6a812b118eefd125f8
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9MCOtTMtPIIzjb6gX3isXG8H7qC4lBDZ8x:0u1YJTHcw2TRvI3btXS+G82nd8x
  • TLSH
    T152232B0037E9C22BF2BE5F78ACF26145867AF6672603D5492CC401DB5713FC69A026FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2