Extracted

• • Target
    fcc4c4e77d5d1bf4ba49c4a3d53f480e3e15da06f54e7f5be17ae2437b6ac268
  • Size 45KB
  • SHA256 fcc4c4e77d5d1bf4ba49c4a3d53f480e3e15da06f54e7f5be17ae2437b6ac268
  • MD5 af4867a9c3f20b5b75d76684840fd0fd
  • SHA1 c3d5852e781308425a0abe7d1e4f72445ca07c2d
  • SHA512 c9d2272ad4d774c428d328504bf886ce0e9e448e9ad0b7d93875d8477ecd83cd4f47a00ed2ae6ecdd017a043db30c15946af700aeae8b44be22626c370c091fa
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFkhk6K7OOPIzzjbPg03iNS6wWDBINUuD6tUJBDZEx:MuLAZTnbg216VO3z3b40SNZDuDzXdEx
  • TLSH
    T1A7232A003BE98227F2BE4F7898F26145467EF5A32603D64D1CC451DB5723BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2