Extracted

• • Target
    f1fea599454c8b4e7d344b265f6fdcb752727ad372b75e71c4eb3c633ffb5e99
  • Size 45KB
  • SHA256 f1fea599454c8b4e7d344b265f6fdcb752727ad372b75e71c4eb3c633ffb5e99
  • MD5 b49202cf0bb97819917806f9c5199e4a
  • SHA1 ce08fb563a251b83ad0a94e612eab0e5219f9584
  • SHA512 2f0f806ab15b73f2fe7d9c7c586660254f613ef9b0aa87a073f1a1ff9714358f236cdd61a4255b76d58e9028783e3238fdee09f43a844d71b35ac86f32d6d1c6
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjMwD/y/aqPIMzjbvgX3iI6x9ijbcuoTiUBDZ8x:0u2vpTDe+2FkhM3bYXSHscHuid8x
  • TLSH
    T1DA232A003BE9C12BF2BF5F74ADF26145857AB6633A03D68D1CC411DB1613BC58A526EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2