Extracted

• • Target
    1bda5f57f1faabc4b521421497bc3be0ea284a91734ede78418806cbb9ca11a1
  • Size 45KB
  • SHA256 1bda5f57f1faabc4b521421497bc3be0ea284a91734ede78418806cbb9ca11a1
  • MD5 d6e2a6114829e4dcbf7a5bbdd5ca9ab3
  • SHA1 a4f3febe61e3594c54b4b8c4ac3afe97907cffe1
  • SHA512 f7a968e13d46ae0aab0f57fb383df50a07e33d3bd049d54669edfed844e385c8d8ecbdd7459e32c6c7ff62287c180d6f474f9534089e1c72e7023ac70971da02
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlL3xY6yZoOPI5zjbpgA3iGt2ECO7pOIBDZMx:wuDWZTpMZSB2OuPo353bmASj27cudMx
  • TLSH
    T1C7231A003BE8812BF2BE4B78A9F26145467AF2A37603D64D1CC452DB5713FC696426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2