Extracted

• • Target
    fe41690c4bc11c14af58b8eba7d1d9e447d6d47288b1ac2b172b9c7c49b1a7ba
  • Size 45KB
  • SHA256 fe41690c4bc11c14af58b8eba7d1d9e447d6d47288b1ac2b172b9c7c49b1a7ba
  • MD5 710f4077cfb791295e6d30c141459e56
  • SHA1 45a406ea13642c933cd62931d1673afc79cf3eed
  • SHA512 541e06e551464e28abdcebaa8889a7c676c88cfb59791af351b3c39d3db384556a438734a2574263c3a4481fd02cc5f22450280c0005f27cd7c16777fe49dd09
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlplsHoPEaMPIPPjb8gX3iLx7pG2g3orp0WBDZMx:wuDWZTpMZSB2IuuEaxP7bTXSN7o2g3oC
  • TLSH
    T136231A003BE9C12BF2BE4B78ACF26145457AF5A33603D68D1CC452DB5613BC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2