Extracted

• • Target
    1f93de067095a63e95e6afa40d6b334193e4da3b6cdcb7ad5efbc514873accb6
  • Size 45KB
  • SHA256 1f93de067095a63e95e6afa40d6b334193e4da3b6cdcb7ad5efbc514873accb6
  • MD5 b467269c3a5af098b5e45bae22832bcf
  • SHA1 28f7d66303063902c9eda66118152780561dce26
  • SHA512 4b6efdac7f4df39eb1ce8abe065afcd987f69de9316685057bb55bdbaa0e783638910d986bc80c6532787d2c9a7dde202eb2ebb3f1182e7993797126212409db
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9EITnyHaaPIYzjblgX3iTttqtCc5bEBBDZsx:EufspTf2g2fE5Y3biXSkCc5bE/dsx
  • TLSH
    T100232B0037E9C12BF2BE4F789DF26145867AF6633603D6891CC4119B5713BC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2