Extracted

• • Target
    fa77492ad60fa0cc0721159d02fce6dd5601f62694edb09b1ab5b8c0e90d54f0
  • Size 45KB
  • SHA256 fa77492ad60fa0cc0721159d02fce6dd5601f62694edb09b1ab5b8c0e90d54f0
  • MD5 4e9178c2b163869e6b9b9e4e827d4986
  • SHA1 5ac7aba40e9b9107d4a4af5ec641051e24f53d32
  • SHA512 4622c18be7d045806b0c9ea3c14ed8dec4c5f9bdf461310acc0c616e47bab1df2b8b18ef2a8f3378708a64358d3e905e92be05dc56ce52baca10e123ea0ec784
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qw2SKFWKoobbb4vhy/nPIALzjbxgX3iInnja9qlabgN:ku40ZTXEb2SSKdivh4AAL3b+XSInm96x
  • TLSH
    T1EF232B003BE8812BF2BF4F7899F26145867AF2633603D58E2CC4519B5713BC69652AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2