Extracted

• • Target
    1a7e1eac77339cfe02790ce89c25c06188ac3dfd49ab5950d1a662dea5aeb180
  • Size 45KB
  • SHA256 1a7e1eac77339cfe02790ce89c25c06188ac3dfd49ab5950d1a662dea5aeb180
  • MD5 31f39bd9dfb052893a901c76f05e0bea
  • SHA1 9cd547331fea7f11ec00993d8910034d02fa0758
  • SHA512 f2af7e11e3fc26b91fd94b81da45c269c67970d837f325797ed5649049dd054b0b0e8aa232bae4c29022ba9aa20488965a0d0ae6ecfd8e0b9ef6f6d627e16147
  • SSDEEP 768:4uBGJTP0BQ0UWUWHaimo2qVzsD/pneqPIkzjbcgX3iFv4nBpilXBDZ4x:4uBGJTPho2QsjJeTk3bzXSFv4nBcTd4x
  • TLSH
    T102231A0037E9822BF2BE4F78A9F26145867AF2637603D54A2CC451DB5613FC68642AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2