Extracted

• • Target
    1d1f6ad164c6a68e8384b9b054aab7e46344d808a8be8f147f42f5316fc17855
  • Size 45KB
  • SHA256 1d1f6ad164c6a68e8384b9b054aab7e46344d808a8be8f147f42f5316fc17855
  • MD5 3175089a06275ed2efbd3bbd36e16000
  • SHA1 d1c5a25bdd3a7eb2e96cdd3b85a4b13e5ee87220
  • SHA512 e35f8d2e4a88ef8f552ff13769bae83a6dd7d96b9939c5505357f8cc89a9343a2d118a57231429c8a33a51f3d8ffb952a3215a6ea8c14a0bc902eac5c831d16a
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFOeeXK5oibbb6TN8/nPI6Wzjb5xgX3i/+OysGai2cCJ:MuLAZTnbg2aeEqTNKA6W3b0XS/fp/u1E
  • TLSH
    T130232B003BE8812BF1BF4FB8A9F26145467AF6732603D94A1CC451DB5713BC696426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2