Extracted

• • Target
    f2fbd80c1a69f57d24fc3a5e9f4bf48dbed90435979c759d98abffc5a53a175b
  • Size 45KB
  • SHA256 f2fbd80c1a69f57d24fc3a5e9f4bf48dbed90435979c759d98abffc5a53a175b
  • MD5 88a398487d740ff66f68c3d5090740fa
  • SHA1 b10d435174c918375dcf8b833d85796561f8943a
  • SHA512 eb1e3a1b03d5af8456625af54b8b78f6260a971763e249916f60b5ed6a4396c365c2202441f4a3b935f43bdb2595dae850679ca7d4a928fbd874681b4d025eff
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4T9YikqHztOPIUzjb1gq3iomTZVpnj4vBDZ0x:8uUIpT4vAj2XalK3U3bSqSdb5jAd0x
  • TLSH
    T10A233B003BE8C12BF2BE5B78ADF26145867EF5673603D64A1CC452D74613BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2