Extracted

• • Target
    1fc2654e5b5398f45d6dad60a08991da7cb34622f8e363cf64e9f66231c96d86
  • Size 45KB
  • SHA256 1fc2654e5b5398f45d6dad60a08991da7cb34622f8e363cf64e9f66231c96d86
  • MD5 a0facd3a4988dac06d5e06c16f5e1d8c
  • SHA1 ef0a1568241d84149dd5470471c9cc799eb43c40
  • SHA512 6f7f2a8b2876223e10dc55af3bb96030861e6f728dfa5a0d659aa62760c2c6e4af18dc76f4c8ba9e52b17e25ef27a8360b9e7c5dfb79435e743c609bab085c84
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFYl9fcBEahPItnjbEgX3iAn0mKROrMfPBDZEx:MuLAZTnbg25LkEa+tjbLXS6FTrMhdEx
  • TLSH
    T111232A003BE8812BF2BE4F78ADF26145467AF6632603D64E1CC401DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2