Extracted

• • Target
    1f97d53b01f381b2cce4fe3bd3b87a28fd30270b6b3c9cb9e054cb6f7c7f91fb
  • Size 45KB
  • SHA256 1f97d53b01f381b2cce4fe3bd3b87a28fd30270b6b3c9cb9e054cb6f7c7f91fb
  • MD5 998fce835fd15a83f2eb7727a8006d80
  • SHA1 aba63df959d61546aef843f066bdd6efebb542c9
  • SHA512 39fd9a11acb92202c06d4b96b79d054d63953d6d4a855de5feb036cf5fbc3f04bf1dac9126ef8b329fb4094783119865d3661c37b79f8c4758da2c543d3e1368
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjUwz/y3qiPI7zjb6gX3ijWZX0rETSAduBDZ8x:0u2vpTDe+290h73btXSjAX0rISACd8x
  • TLSH
    T19B232B003BE8C12BF2BE5F789DF26145867AB6633A03D54D1CC052DB5713BC59A12AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2