Extracted

• • Target
    fc88a3f5f3bf45670871c19aefddbdff690f8ceda831538a620a79e68a386733
  • Size 45KB
  • SHA256 fc88a3f5f3bf45670871c19aefddbdff690f8ceda831538a620a79e68a386733
  • MD5 ba299f1197ff3d4c089d9749fa416728
  • SHA1 9c4e454b59a1a17a1b862639fb4699a8eb452370
  • SHA512 ade5b7cc09a484ccabd5676610f65469c1f7e11aff34f36b327e0c4969206ff6855f8d7a9eb16490519f79554a7385eca9e6e01ee8628d69d9687b0f83d997a4
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9aCSwTMSPI5ejbXgX3ikVb7mz3ZogBDZ8x:0u1YJTHcw2NgG5SbwXSkx7c7d8x
  • TLSH
    T1B4232B1037E8812BF2BE4F78ACF26145867AE5673603D58A1CC451DB5723FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2