Extracted

• • Target
    fb57594a99aa355af30649d11257a683a7b08cf98f14450a74b3601935309e39
  • Size 45KB
  • SHA256 fb57594a99aa355af30649d11257a683a7b08cf98f14450a74b3601935309e39
  • MD5 991afdd24274208fa9920f7a9e5c8817
  • SHA1 bbcb3a827d9f3d63321db03bdc99e9f30bc06142
  • SHA512 ac23e8a5edebc40ba006fa4c12bf9b5af45e405a889a3175e82a809658e016548f9b5e873152645fa84529564806f17ae5e484d1f8a6c35e2b864e73bafd4f91
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVOT9Qpm9PIszjbmgX3iA4I5xydCBYQGKVTBDZkx:suJdpTPdI2ZQs3b5XSAPvwiuKV1dkx
  • TLSH
    T12F232B003BD8823BF2BE4B7899F26145867AF6633703D54E6CC451D75623FC68A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2