Extracted

• • Target
    fc8c7ce5fb936c3a130fb94ee5366d2d89a15a18269e3f71f3cc221f428588ad
  • Size 45KB
  • SHA256 fc8c7ce5fb936c3a130fb94ee5366d2d89a15a18269e3f71f3cc221f428588ad
  • MD5 a09398f52ff682f5a16d5d0b5b1c1d2e
  • SHA1 0891a32d03be8aebfd9a3f7b8c048cdb414ec9b9
  • SHA512 187f7c7a79cf899d32b7d4fa2f4ff16974b23c6b2f07a69f3d96a99456ba5198145f4980dcbb37e5d87ade42fff8ce12df34c5521c0e40986324df000becc116
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNC9Yq3q3hOPI2zjbQgX3i/SWInpxpp3zRBDZ0x:5uSy6pTpoo2/aCq323bXXSDExpld0x
  • TLSH
    T1FE232A003BE9C12BF2BE4F78ACF26145467AF2672603D5491CC4529B5623FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2