Extracted

• • Target
    1dfa3efb31b7eaff51c8178d221e63f14b5b17ba715b4b43517b34e42d87ff3d
  • Size 45KB
  • SHA256 1dfa3efb31b7eaff51c8178d221e63f14b5b17ba715b4b43517b34e42d87ff3d
  • MD5 e2856fc2b0cdcd965f562a18742c5a10
  • SHA1 b75da777ed30fc4239a8714cee1ac1e659d11fcf
  • SHA512 a87da73e9137048a8347ce56e11e4f3a9c283cc43ade4d7b532596304fa83c2a3a305fc31585eb73106bcedb7288732993381ea758f9dd669c8504add08c208a
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVOT9Qpm9PIbzjbVgX3iH5BS8RU4BDZkx:suJdpTPdI2ZQb3byXSH++dkx
  • TLSH
    T1AA231A003BE8863BF27E4FB868F26145467AF5632603D5496CC412DB5A23FC6CA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2