Extracted

• • Target
    fb57e48af29c0309b26b92155eb50457ade35e890c2b8d73dd453e3dd8b885ee
  • Size 45KB
  • SHA256 fb57e48af29c0309b26b92155eb50457ade35e890c2b8d73dd453e3dd8b885ee
  • MD5 82a5164bb5feb5e87a6ba9d994a599ca
  • SHA1 dcdb79b6c904af01144dd7688e9551f78fbb662f
  • SHA512 5400ddb85cf12904ad7d2e9aaff215a619128743124c2d139d2e343df39334cb9e09c85f3c1e2f1426773e4ca305e468efd8f1774c8f5e2be33ffe65c9311b6d
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAaL5P02FUFdiYkk8PIQzjbTgX3is2Z0+M1ypkBDZMx:kuSOpTPOP2KLDmhBQ3bMXSs27M4SdMx
  • TLSH
    T19D232B003BE9C12BF2BE4B7459F26245867BF6732603D64A1C8451DB5723BC58A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2