Extracted

• • Target
    fca79eea2d0cc27bf8edd78ce5fea304a307c4e37663e68026407bc45e748692
  • Size 45KB
  • SHA256 fca79eea2d0cc27bf8edd78ce5fea304a307c4e37663e68026407bc45e748692
  • MD5 9b0e190bb86326f0d7935222caf7434d
  • SHA1 62a5219292740849ed3d44558ebb051b1f039c6a
  • SHA512 7302ef6a2cc11eaa0451c7240cee50010d810b95a2fa88e00bae8fb3bd5511b6c11b8bb961ec3488a614fa729fc668ab6836ee37572ebe98b6d7fd91e7822f9f
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFV3HE4eVoOPIGjzjbPga3iVOwaxb5BDZUx:cu7e5TH2A2EU1o3Gj3b4aSVOwaFndUx
  • TLSH
    T1BF232B003BE8C22BF2BE4F7899F26145467AF6A37603D54E2CC452975623FC686426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2