Extracted

• • Target
    fe9acfffda307f215dc5055836de481f924a3b67e233775b905da383f258c71f
  • Size 45KB
  • SHA256 fe9acfffda307f215dc5055836de481f924a3b67e233775b905da383f258c71f
  • MD5 b54f378d2edd84acb7d35b98fe68d9c4
  • SHA1 967272991f7f9fc41c24e6639456a8e692f8c496
  • SHA512 4e32483462531bdb4c28ad4417087a40fc1ed47eb5623e5fb07244bc551bd999198de126ed0c57eb122752e0dedd00a2ee6db277fa186ec8606e68c3f100ac9d
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9IDEbHBqj2OPI/pzjbKgX3ihosbYi4fIczoaoBDZ8x:0u1YJTHcw2HyoK3/p3bdXShfj4nqd8x
  • TLSH
    T1D2232B0037E8813BF27E4FB89CF26145867AF6633602D54A1CC451DB5623FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2