Extracted

• • Target
    0fcb1ffe04e71324e1ee1b026489f22a8ff93ef40b4e932a69ad001200e86fc4
  • Size 45KB
  • SHA256 0fcb1ffe04e71324e1ee1b026489f22a8ff93ef40b4e932a69ad001200e86fc4
  • MD5 6a92084363204b9064e8552b905e0c0d
  • SHA1 ad619ef86760bce204437462a9aa34b175f76e06
  • SHA512 e84866172519454b8e97097a3bab97f94256c96f5433692fb9f072c27d7839b9fa130fc7b5675c2833f3fdf9ece2692b4c86028908efaa6a6c2ea93715866945
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA5Bz5U4x7PIgTjb0gX3iNyGSOvflkrZu1e1BDZcx:UuKWgSJTwRf2pj6gXbbXSNypgf2Zu1es
  • TLSH
    T1ED231B003BE9823BF2BE4F7898F26145867AF6633603D58D6CC451DB5623BC686426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2