Extracted

• • Target
    1ff2067e47962159ccdb681889f1223c39ee41c50fb2b73e8f85fffab29adc93
  • Size 45KB
  • SHA256 1ff2067e47962159ccdb681889f1223c39ee41c50fb2b73e8f85fffab29adc93
  • MD5 77d6f77f330250ce4105f2d78706459e
  • SHA1 1717a4f4cd6eaeffcce8fff1698a856edfa286d8
  • SHA512 a30959fd120ca966447ecf0efb7df059e21b882f1556c94cc669ec44cea6a0719d4a4b8854d697fbe224a2362bf9467ec0cad20123f12add1a5942e683094d25
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9q9wScq/z1OPIszjbJgU3ioYdhfnS1yJttl9BDZ8x:0uPrpT/qY2ni9K3s3bGUSo6ZSgzLd8x
  • TLSH
    T1A0232A003BE9C12BF2BE5B7898F26105867AF1633603D64A1CC452DB5713FC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2