Extracted

• • Target
    1fd04922a473e424b7e08d35d239a09ee83daf43f5120239bbd55f4bb62f6cc7
  • Size 45KB
  • SHA256 1fd04922a473e424b7e08d35d239a09ee83daf43f5120239bbd55f4bb62f6cc7
  • MD5 5c6600b06b45701679f77bbee8588ca4
  • SHA1 49b75cbeb4cd3d9ce76ecd25c84629f597bbd09c
  • SHA512 11f888feee05cd77cae4eac1b4d8a5e1a51a414d7d7b2730f115b078a76be769b0153d90be4f7b4d84b30fe8451a4d76de2fa9895b83aba5987a7254b62ee020
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVj0b3NLAteiZPImzjbsgZ3iHmk1OToAHYfh8BDZEx:MuBGJTPho2/3ZhiWm3bjZSN+oA4fhadG
  • TLSH
    T13B23090037E8C12BF2BE4F78A9F26245867AF6732603D5491CC451DB5623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2