Extracted

• • Target
    fd8f67e96eb74ce760bb7168b6f012aa52f69043155b17c250f9954a46d3ad88
  • Size 45KB
  • SHA256 fd8f67e96eb74ce760bb7168b6f012aa52f69043155b17c250f9954a46d3ad88
  • MD5 54df2de3a43ec068ebf0931c08b5e1f7
  • SHA1 a0cf8b01141b10dd5dc47c05d8cea495b7bcd1c6
  • SHA512 aa455ae66358899487ec3c078b8241329f1419162da1857f1388d00da5c3f18cf5debf9aff6b427fba435091dbc88d62a8f8f33467a6ceb198f4a0456b9097e1
  • SSDEEP 768:4uBGJTP0BQ0UWUWHaimo2qVzsD/pneqPIkzjbHgX3irBWv7wUtCZC3eBDZ4x:4uBGJTPho2QsjJeTk3bAXSrywUtCpd4x
  • TLSH
    T1F5232A0037E9822BF2BE5F78ADF26145867AF6633603D54A1CC4418B5623FC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2