Extracted

• • Target
    1a0b126d76a59c07955077bad15346033d6db50512fb4bc801f66b079e41e152
  • Size 45KB
  • SHA256 1a0b126d76a59c07955077bad15346033d6db50512fb4bc801f66b079e41e152
  • MD5 dac1a611eaecde981f728cff5a9b7d6c
  • SHA1 29c68122304a2c15a24ba4d7f8cf0207c311cdd5
  • SHA512 4d29211dd2c07f97e91e391808fbdfa91c0f1fd9236ec4f2237f750dd31519848e5a918cba9bad7c222efeae1369fb7cf0d533826f0d543577bfc4862ab41779
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVMw0QUKXPI0zjbLgX3iVYJTcN1IgmhHBDZkx:suJdpTPdI2Rf03b0XSEsidkx
  • TLSH
    T13F232B003BD8812BF2BE4FB86CF26145457AF6633603D64D2CC452DB5623FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2