Extracted

• • Target
    fe3f610f7ed9051f9d2847c87f6bedc4c4cf1b70e1e0d139ccbc7cc18b4dae8c
  • Size 45KB
  • SHA256 fe3f610f7ed9051f9d2847c87f6bedc4c4cf1b70e1e0d139ccbc7cc18b4dae8c
  • MD5 078dd4be400e45f6630f8dba36a8f88a
  • SHA1 8d5d7cc424402505180911a18da7d599ffa19e3c
  • SHA512 d8160c724bbd88f080aa37e1dbc80153adb7abda55d146460b8daf0e947e0e0c8fae777e5d79db7aa71192e967903894dada11d4201977c8aacf35a46f5be9dc
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98ITnyfaaPIAzjbNgX3iGQYOkOH1IgfSZBDZsx:EufspTf2g23EhA3baXSGQYOkOFfSHdsx
  • TLSH
    T1FD233B0037E8C12BF2BE5F7899F26145867AF6632A03D5491CC412DB5723FC69A12AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2