Extracted

• • Target
    1fbd94d1e98163f12cae95faa0ef462f05b097568bd024600e1c686e9e4d0d4f
  • Size 45KB
  • SHA256 1fbd94d1e98163f12cae95faa0ef462f05b097568bd024600e1c686e9e4d0d4f
  • MD5 f0d2b7673756090f226c3bbefc397fdf
  • SHA1 2220e6fb953cb90da88e8d4fb052b3a64e3209dd
  • SHA512 a9b26b9dc414208935d88d255bb1b5638fabd763c68d58dada0b220a5b105194d5db73ddd0b3ad4f29f6d3bd7cfe16cb7be9ba08634a75a4085889328343412f
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9zCOtTMtPIFzjbrgX3ipT7f9OBSYX2r2sBDZsx:EulCJTHl42MRvF3bUXSR7wB9/qdsx
  • TLSH
    T14F232B0037E8C12BF2BE5F7899F261458A7AF2673603D54D1CC451DB5613BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2