Extracted

• • Target
    fa28aa81c8edfb94accfdb68903c36300460083670e56f498063601d8a5a5f6e
  • Size 45KB
  • SHA256 fa28aa81c8edfb94accfdb68903c36300460083670e56f498063601d8a5a5f6e
  • MD5 a4e5b3a6291dbfd64d1145d855e3c5d8
  • SHA1 7e7ff54e95c5373bd15e002d0945b411d3f988a4
  • SHA512 ccefd3fa32dbb62d8643564132c32ab29d65465ee264f08567f3942c1fabf112171853ef2d273a1843176a3f749c1a8f887318c1619e7a27db4bd5430e860bdf
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1HmaPcl83APITpzjbIgX3iP9S9TJo4yABDZUx:cu6YepTPso2WfcS3lTp3bfXSP9S9T5dW
  • TLSH
    T186232A003BE8813BF2BE5F7899F26145867AF6636603D64D1CC451DB4A23FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2