Extracted

• • Target
    f0260d9607d4a53f0ce19d14b3742649c2ec0daeffd7a0c22bd9de05a5562894
  • Size 45KB
  • SHA256 f0260d9607d4a53f0ce19d14b3742649c2ec0daeffd7a0c22bd9de05a5562894
  • MD5 9fad42460278c0be1cc3b1921f2fb9fa
  • SHA1 71160ea4a5d4f1286e81e0d1de25afaf86b9822b
  • SHA512 8799e5603dcac4bdc8a752e4d706de532b4a8cdb49eafc6111fd1c5fd18f91a1822c2e3e8340581cd3e31396e9388f63e1e89a68782f18f94df69e315aa11eef
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAfmaPcl83APITpzjbtgX3iuGPO15MBDZcx:UuKWgSJTwRf2vfcS3lTp3b6XSuGPOjKs
  • TLSH
    T1732329003BE8812BF2BE4B7899F26105867AF6637603D64E1CC451DB5723FC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2