Extracted

• • Target
    fb1ad8c3244d4b7af5f00232e83c5f0c0382b4b787a0639a67edb41c6cde74c3
  • Size 45KB
  • SHA256 fb1ad8c3244d4b7af5f00232e83c5f0c0382b4b787a0639a67edb41c6cde74c3
  • MD5 4999628729322e410c33da6436c756a9
  • SHA1 013afa28a2b388a0c578dcf321921c1dbb9f7dae
  • SHA512 d4cbd6fa684641a73b56d7ab61f9bedba60d46b99a03e10c29bd5d2722288d4bd1c82751c448de827912d9375b04a36d84726b42617e395cefabf04b1bfa59d4
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1Jw0QUKXPIfzjbWgX3itl3z0SkWmD8wYDwpzBDZW:cu6YepTPso22ff3bJXSPo5YD8dUx
  • TLSH
    T19D232A003BE88237F2BE4F7899F26145867AF5632603D64E2CC451DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2