Extracted

• • Target
    fc7d6ab6ad593ad544c71607f66667b4de8168055ed5f3ceae63d4733a0c2c90
  • Size 45KB
  • SHA256 fc7d6ab6ad593ad544c71607f66667b4de8168055ed5f3ceae63d4733a0c2c90
  • MD5 8be46065eb146cd6d9ec92fdaa75f660
  • SHA1 3465712000c1629e19cecaa3412ce916cc4967a0
  • SHA512 d51df2423bfcb2f41d8e6761ae910805142f090e48008261ed8ce7a486868797bbdc1ca2fff78b41cc5d472807a17e9f97ec6b296bfc8616f6f55ff24b84412b
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9Ln1YJBOPIx7zjbmgB3ibU276Eux6QBDZsx:EulCJTHl422iz3x73b5BSA5+Gdsx
  • TLSH
    T14523190037E8822AF2BE4F7899F26145867AF5637603D68E1CC451DB5713FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2