Extracted

• • Target
    fcb390aefb03cccdd5fc12e2a46562b5c937067ea82de405dce8e42a569b192b
  • Size 45KB
  • SHA256 fcb390aefb03cccdd5fc12e2a46562b5c937067ea82de405dce8e42a569b192b
  • MD5 acce98402e14cf674691b2b3485e611b
  • SHA1 411c374705d3fed450e40fb68c23b665c30e79b9
  • SHA512 b101831e19f5bf388822d43826805ba2b5e981658ef1c526dfa9503b1a32f2c29aca3d29cfd1f1ed4913db3ba09960a62f54c3bd7eb05a23a81fd3d1cb98870b
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qN9O5QPCBjPSNjPI/zjblgX3ijePVxqaJ4NGBDZ0x:5uSy6pTpoo2MO5sMSK/3biXSKPVM8Pd2
  • TLSH
    T150232A103BE9C22BF2BE5F7898F26141467EF2637603E9492CC451DB1613BC6D642AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2