Extracted

• • Target
    fdad344ec65a6153c6026a2c84c93309b7e831941c93a07d61441a4f85c1c75a
  • Size 45KB
  • SHA256 fdad344ec65a6153c6026a2c84c93309b7e831941c93a07d61441a4f85c1c75a
  • MD5 809b8001cb01807b70549303163c2030
  • SHA1 80fbc22050f9e89391bbdcf9e2799e1bb469a902
  • SHA512 cef78afc74d4ceddd91b49ef37443a54bca80f70aa48b1882aeb7d66e8907451d89fde4544eb924809d5320ab81d8afed6a8daeba1208ca748959382ed75ea1f
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYNhkJHJxOPIcPzjbngg3ic9cyHt8zUMjkYrBDZ0x:8uuSpTgyf2URj3cP3bggSfEtyUMjx9d2
  • TLSH
    T1A62319003BD8C22BF1BE4F7899F26245867EB6633603D58A1CC452DB5613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2