Extracted

• • Target
    1b01ff3b4a4fc0e5c75fed21bcd3205b5104c6442a0153252e67253a12c00128
  • Size 45KB
  • SHA256 1b01ff3b4a4fc0e5c75fed21bcd3205b5104c6442a0153252e67253a12c00128
  • MD5 e6492158448912a2aa6a0104b3620f56
  • SHA1 3fa489b759fa899a719ab4128edc91cd23543ffb
  • SHA512 af1ec2fe859721828f7bf7a3af01b866678de74f370b9ca800fc2a2ed4d299f814ba3ed062ff81babd6755fa1c74bbe851255579887c5f632bdc9b9b906c2da5
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1e/ycy3APIMzjbhgX3TFdFIozKj7E4BDZUx:cu6YepTPso2vq/3lM3bOXDfqozeJdUx
  • TLSH
    T103232A003BE9813BF27E4FB899F26145467AF2637602D64E1CC451DB4623FC2DA42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2