Extracted

• • Target
    1b7b842f72341690a40b95bc3717071b2f3f986a68e6d07ff92e00086e3ebae0
  • Size 45KB
  • SHA256 1b7b842f72341690a40b95bc3717071b2f3f986a68e6d07ff92e00086e3ebae0
  • MD5 703adac897d2f4ce14bd1f66f663da8a
  • SHA1 27fd446b0b4b0c50d8844e9b6d171f19ce08bdbc
  • SHA512 1b368065a1422fbd3b59e105489cac9a1ec1b1d3b48dfcada20f37968d669fc6ab69f41868f7ebc76193a88a50e38884bfaad2a9366663d5fe88148ddec25efd
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtOoRbNIFOPIAzjb3gc3izuN662gkFi5bBDZ0x:5udApTNmU2hYZ83A3bQcSzq2Uvd0x
  • TLSH
    T1F7232B003BE9812BF1BE4F78ADF26145427AF5673603D64A1CC451DB4623BC6DA42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2