Extracted

• • Target
    1a7af13deb90c65f7a939b82a57f91e0ded9a7adf2334e912cdbb316bbfc2032
  • Size 45KB
  • SHA256 1a7af13deb90c65f7a939b82a57f91e0ded9a7adf2334e912cdbb316bbfc2032
  • MD5 d73c619cb4f459e7d15d99c4eeda34a0
  • SHA1 e61c17b8ba8cde385bc921f67c0ef58d8e07a086
  • SHA512 0c2120aad305a803c06ecd7d9976c468fd75ec71730a0498d907b1331c5c104777d44a3c68aa69e3819a9815066189db48c0bddb77c36b4cd892325edc170fd8
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q479Yq3qvhOPI9zjbAgX3iVu4i0X2HBDZ0x:8uUIpT4vAj2/aCC393bnXSw4dmd0x
  • TLSH
    T167231A003BE8C12BF2BE4F7898F26145467EE6633603D6491CC452DA5723FC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2