Extracted

• • Target
    1f6aa680e1397b8121ec642dee185be0b6bf22f666ef7704fda9632e4c32170c
  • Size 45KB
  • SHA256 1f6aa680e1397b8121ec642dee185be0b6bf22f666ef7704fda9632e4c32170c
  • MD5 b0cfd7f63df98a6b51d3660c6a97f9be
  • SHA1 5512f2208b1c92fe4dcb785a66d9caf32ba9a2a2
  • SHA512 8be4d962755fa206f23d719bdd9aa90c43ae51799045932b4367bc90d4e00496437a463398b070f702ae5ef5388f3667fea18452c87e6f65bc8a2998bd915e4b
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFMSAFcKoabbb4ZhM/RPIAEzjbggX3iupbyTfej1jwk1:MuLAZTnbg2vSAvQZh6OAE3bHXSupb2fs
  • TLSH
    T16C232B003BE8812BF2BE4FB869F26145867EF5633603E58E1CC452975613FC686526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2