Extracted

• • Target
    feaf7321c5e3dab39a7e64b472e267c26707fcc436b24832fca66ad3b4c65775
  • Size 45KB
  • SHA256 feaf7321c5e3dab39a7e64b472e267c26707fcc436b24832fca66ad3b4c65775
  • MD5 49ac8205cd8a84d0559ef5552110e57c
  • SHA1 eeb7975eb1ec73552acd98a798092cb8cec7732f
  • SHA512 f79aad621f1dbcfe42c6f902c92b30461f4dc95cd4666c317d5da85665bc324d8ea2b53705777e308814b6af5d2e447c76eae5b6170a50277b88719c15b3ce6b
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYfDEbHBqj2OPI/pzjbigX3i57W536UiVZHGTBDZ0x:8uuSpTgyf23yoK3/p3bFXSA5KURd0x
  • TLSH
    T17E23FA0037E8C12BF2BE4F7899F26145867AF6633603E54A1CC451DB5613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2