Extracted

• • Target
    fd062b71b0353bb4a70c1095566b75164b16db49c2afa28ab8cc5755e4523f7b
  • Size 45KB
  • SHA256 fd062b71b0353bb4a70c1095566b75164b16db49c2afa28ab8cc5755e4523f7b
  • MD5 c6e7ace2f6bea8bb37686e4cee6c475b
  • SHA1 9f9a6f34820da461a83e5e8746b1e7f0f7e7f01c
  • SHA512 fef21d9da060151d7acbd841c711d5e56bad5795dfdfef3228c3e576bac6cd7fdf4ae95a2ed189ccf936ac2220de184af15f91103c9c404f57bd0913fb47a7b3
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9r9wScq/z1OPIszjbbgS3iZxo6Xa13BDZsx:EufspTf2g2mi9K3s3bkSSZxo60xdsx
  • TLSH
    T14A232A0037E9C12BF2BF5F78A8F26145467AF6733603D64A1CC4119B5623BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2