Extracted

• • Target
    fb425975d3fb3507da7dd1e0c2995684139c3dea5ef2090ae95036fb85058c76
  • Size 45KB
  • SHA256 fb425975d3fb3507da7dd1e0c2995684139c3dea5ef2090ae95036fb85058c76
  • MD5 e90181a7abb2a2d7102846131d20b949
  • SHA1 21a6de0a394ebcd8fa9e86c0cab426836fa74dbe
  • SHA512 9160c6e36e562077d2c673cffe81408c5cbe1dee8429f7dd7bfae014d9a492362a59596de3c36468f247ad1c848a794c57fa64808c92bb5f81ad4b89306bcce4
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyL5P02FUFdxYkk8PIvzjb9gX3isJ+TnHkIedXUhBE:MuBGJTPho2/LDmWBv3bqXSsgTHkt1UfE
  • TLSH
    T123231A0037E9812BF2BE4F78ADF26145867AF5636603D64D1C8451DB1A23FC68643AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2