Extracted

• • Target
    f002ad29375b3e06b833051fe09aa743a7c545c9f46430a5aacd99c00b6d6c3e
  • Size 45KB
  • SHA256 f002ad29375b3e06b833051fe09aa743a7c545c9f46430a5aacd99c00b6d6c3e
  • MD5 a62383afc3fe7a9d8e5f26b170d14d8a
  • SHA1 04b7ac7feb7a912a43905c4f8c005da15af80872
  • SHA512 3684738318075b947c29ee4cc8fb79ab77bb7023c212859d6a0bb8a1032d08246a5b07b8e8522b01113025f6d24803c936a304e51455df4142ea5a2253aa12d6
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVJpt0CCM+d4CvS8PIkrjb+gX3it55aXcGDd7jBDZEx:MuBGJTPho2Q/CFWBk/bBXSLccGR7ldEx
  • TLSH
    T118231A0037E8812BF1BE4F78A8F26245867AF6737603D54A1CC451DB5623BC68A536FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2