Extracted

• • Target
    fd228ca8a27a1484d4b59c6853f666320580b015675d31446de1eb268789770a
  • Size 45KB
  • SHA256 fd228ca8a27a1484d4b59c6853f666320580b015675d31446de1eb268789770a
  • MD5 11b3eb8b7109c960f6522c5fae975604
  • SHA1 317ed609300c059540fe8ef126bda3a78985661a
  • SHA512 33ebe3d3613c05d8ffc8ca2a35459724a2252feda0f1b97845ac684ac9c8540156d6d20b8b0dc010a7b9dab624d02028631ec7dbae09dcb6ba4f89f0be0697a8
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFUlsNoPEaMPIcYjb1gX3ig+FhP/h+7fUH/BDZEx:MuLAZTnbg2tsuEaxcQbSXSLjH4QJdEx
  • TLSH
    T1A4232A003BE8826BF2BE4F78ADF26145867AF6736603D5491CC401D75B13FC69A42AF9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2