Extracted

• • Target
    faab1cb0a5f1f3066340fc37d8622d267d2c1571a046ff17a7a1972daa808bdb
  • Size 45KB
  • SHA256 faab1cb0a5f1f3066340fc37d8622d267d2c1571a046ff17a7a1972daa808bdb
  • MD5 5aa13d1f9594d2a31e64385741433c56
  • SHA1 0a73caf9dc776796d356aff2b59694571f64c507
  • SHA512 d10c6088cf01d10e223c465436123af55acbb650e0efccabc0401aca11cb5cf7b08cf1434be9e7e2679da5396f1cff7acf7ebdb4ea6434363f623640e1cfb802
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9b9YikqHztOPIUzjbhgG3i0MiYScLYcm0NBDZsx:EufspTf2g2WalK3U3bOGS0MiYJYV0Ddu
  • TLSH
    T139232B0037E9C12BF2BF5FB8ADF26105467AF1632603D64A2CC452975623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2