Extracted

• • Target
    fbb242614505a7769504d0b6b0f313884aa48454525dd1e2ae0ad9f69df388e7
  • Size 45KB
  • SHA256 fbb242614505a7769504d0b6b0f313884aa48454525dd1e2ae0ad9f69df388e7
  • MD5 89fe618f96e47e192b9bdcc0f0250f99
  • SHA1 fe8e7352e8942563f6d1968c8bb9a7a6a014bced
  • SHA512 741d0b5cd8f68f32e93c26f9cb2e681c25b605f843f46cc70b812cb502f9167d3d888d6a0964c2f711090109ac8a5a768df004f7ab31425a82a7c45c6bf6b183
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFPeeXKGoibbb6tN8/nPI6DzjbigX3i7JXZTptHs96j:cu7e5TH2A27eDqtNKA6D3bFXS97eWEdW
  • TLSH
    T171231B003BE9812BF2BF4F7899F261458A7AF2633603D54A1CC451975613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2