Extracted

• • Target
    fa5fd5f2c81c4db196ad364acc47103ad07792624115a822864bef1a6daec81e
  • Size 45KB
  • SHA256 fa5fd5f2c81c4db196ad364acc47103ad07792624115a822864bef1a6daec81e
  • MD5 fe998053d0db4761743a63c0dca85bb7
  • SHA1 1e1def299a813e3f5599cc0e855712c843ec320c
  • SHA512 f7c6e3425f14dbc79534b81c78dcba17171334ff56ed60465d80c4395930e285ec62cfb61bca19fee1ef39bd0b20babcab95645746af201cb46ae9578d9faa17
  • SSDEEP 768:5udApTNctooWUS7C+mo2qt5HO9YjoHPICYzjbzgX3i5wMTkdeZeWC07ioX39Cc8V:5udApTNmU2Z6kgCY3bsXS5zsT07ic9C3
  • TLSH
    T1BC231B003BE8822BF2BE4F78A9F26145467AF6637603D5891CC451D75723FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2