Extracted

• • Target
    feb411512141f022d5cb49c81ee10c291ea9a6d137e8404dbd86e0f93dbb6266
  • Size 45KB
  • SHA256 feb411512141f022d5cb49c81ee10c291ea9a6d137e8404dbd86e0f93dbb6266
  • MD5 56a2770842529065d94a72f8e31bf264
  • SHA1 233c556177a7179f2b626b4a77a7c67b3f3ec54d
  • SHA512 6d11b53ff59dc369bd0c5c69bac0f1aadce14f59d76a6ca43a41f74aa2cf1cab2e580c11d8dfa63faf42b121dd6e127f9ee74efebffcb3d69662c1229a78b4f9
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAp0e3NEAKViZPIazjbBgU3i14fLXw/tHTEgHBDZMx:kuSOpTPOP2t3exiWa3buUS2A/x5hdMx
  • TLSH
    T180231B003BE9823BF2BE4F7858F26245867AF6632603D5491CC451DB5613FC69A43AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2