Extracted

• • Target
    fd0c762ca1bb8c66f5dbbd60c6ad4f4de036bf93d881d0fcce2544f98bfa9b3e
  • Size 45KB
  • SHA256 fd0c762ca1bb8c66f5dbbd60c6ad4f4de036bf93d881d0fcce2544f98bfa9b3e
  • MD5 b15e671dc0be3211e429f31ec02b2980
  • SHA1 46b71777ee7d46c2d89e943b91cd4e4fb8f3a33a
  • SHA512 25bd27b20102ea45cf673fe7f0c469422ec68704a131d007f159b82614bbb31ccc876c6765a2ccf562ac947576b2314754650380a6392741437db183e09bd7ea
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1umaPclm3API7zjbIgX3iAJu/HIvwyBDZcx:RuxkJTgip2PfcE3l73bfXSFPudcx
  • TLSH
    T1F6232A0037E9812BF2BE4F78A8F26145467AF6637603D64A1CC452DB4623FC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2