Extracted

• • Target
    fb27b217b6ca2d80775e8ec35ad40abebe816d5a72d12e1d52a4a61391b608ff
  • Size 45KB
  • SHA256 fb27b217b6ca2d80775e8ec35ad40abebe816d5a72d12e1d52a4a61391b608ff
  • MD5 1dac2bf4977efd0e410b078c6fe511bc
  • SHA1 d059b87f63dda7cf797eaafd8a3c3a60e7271fe8
  • SHA512 d9f751057761da98a93c72af3f50b9e449016be51afac178f59c6d3a1c6515d666b13c91ca4678fe097174f219fc0c1eafbe0bd0fa96a09cf8281abd1f9e0c16
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9zITnyHaaPI+OzjbhgX3ixCEErRD3r0KBDZ8x:0uPrpT/qY2QE5+O3bOXSxC3D3Bd8x
  • TLSH
    T1C5232B003BE9C12BF2BE4F789DF26105467AF6633603D68D1CC4119B5613BC6DA52AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2