Extracted

• • Target
    fb32026d8db73ba7f5ef6cfe5854b3bce87574f7db263c3ec87720995500bab0
  • Size 45KB
  • SHA256 fb32026d8db73ba7f5ef6cfe5854b3bce87574f7db263c3ec87720995500bab0
  • MD5 24bb4d74b0d55d17e49c100b12cda9bc
  • SHA1 6076c06e4c3ea233936f803c271e772065da074c
  • SHA512 bb100b94db16cfe193712ab46facad73c2ae8874bd0dcb395802d88be06d78016579a69c806fd6969e34a4c217c88f257a0b5ee4aa58ad27c3cb2d3155b7b3d4
  • SSDEEP 768:4uBGJTP0BQ0UWUWHaimo2qVzsD/pneqPIkzjb6gX3ixF3+Ku0MBfUMMn/BDZ4x:4uBGJTPho2QsjJeTk3btXSxFc0MBfEdq
  • TLSH
    T1DE233A003BE9813BF2BE4F789CF26145867AF6632603D5892CC4519B5613FC6C692AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2