Extracted

• • Target
    1aad683e250d8b7e58c3acc1376a1b89a378f4852898ae4b4051720eb3776619
  • Size 45KB
  • SHA256 1aad683e250d8b7e58c3acc1376a1b89a378f4852898ae4b4051720eb3776619
  • MD5 32b46d6c30e7574abc56b2b4ddb771d9
  • SHA1 f6b03ef99cfc6c05c6b2e5017d48433db3c95224
  • SHA512 c24f6195b63bdf37ea1c3e406a64bfec251035347fea6196fbb250c4063f4b222676311f0e63f78d6d6df32fa8a346db17027379ad7283a98f5a699eaf3f8982
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9AozHy3CKPI2ZjbpYgX3iWqIdaVarKzqkTBDZsx:EufspTf2g28rR2ZbpXSWRDrKmk1dsx
  • TLSH
    T1A2231B003BE9C12BF2BE5F7499F26145467AF6732603D64A1CC411DB5B23BC58A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2