Extracted

• • Target
    1f1b8adc2dbc783d001d8beb21200698f3ed54d70ff35b497f4a26daf73fc9a8
  • Size 45KB
  • SHA256 1f1b8adc2dbc783d001d8beb21200698f3ed54d70ff35b497f4a26daf73fc9a8
  • MD5 50040a53bfb77618bafc42b1ee9e9e65
  • SHA1 b1db823f64dcd64c3a723cc444c90f7a4e907ed8
  • SHA512 618896fff64c05ba42631683c578a4c169ec8890d33338fed649498b09e0d07f9b1415162adcf6220dd2c2709ae824647e5950f9695326c44a1e938aca93a898
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qABw0QbKXPIBzjbHgX3izKuakUmu2y9cCvhBDZcx:UuKWgSJTwRf2Z8B3bAXSzKlkVu2svfde
  • TLSH
    T12D232A003BE9813BF27E4FB89CF26145867AF6637603D9492CC4519B5623FC686426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2