Extracted

• • Target
    1b5b26055d744c1a434ed63b1e79096c09255a604bded4fce4bdc39ce81e0c45
  • Size 45KB
  • SHA256 1b5b26055d744c1a434ed63b1e79096c09255a604bded4fce4bdc39ce81e0c45
  • MD5 dfc9c2e61b617eb08fb76f51b8243e04
  • SHA1 6eba1f6ebba4c8fdaea03bd78cf28fbc2341dacc
  • SHA512 1e7ee3ba143a7c2a92f89452cabc9cf087056a1a0bddcf10bde382b943479a69d50084f6faf71f390bdc7bab8d94d947f9e84d30d97f2191f44b1bfe74b82957
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFvzdAAyPMlL8TfPIMWzjb9gX395eH2lCUhaw6S1hKlv:MuLAZTnbg26lvlL+4MW3bqXNkH2lbJlq
  • TLSH
    T11F232B003BE8C12BF2BE4F7899F26145867AF6632603D64A1CC451DB5B13FC69642AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2