Extracted

• • Target
    fbe2b712d7fb7656eacb7fa31fad18d6d01748c3de98c98565380386fa14f19e
  • Size 45KB
  • SHA256 fbe2b712d7fb7656eacb7fa31fad18d6d01748c3de98c98565380386fa14f19e
  • MD5 b287d4cebd01122ad80fb4aa0b52fb1c
  • SHA1 3aae2b2c894149f490f0362fd203362e9c0c7f7e
  • SHA512 6ac7c5410fee7a34e716349f5d06813a32173198d03d2446cd4b24621648764aaa43c573b2c7baa0aa14dcb0b5c44652d3695dcbff45ce1b5a9dc662d4c9b6db
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1WT9Qpm9PI9zjbjgX3iHGZ76zAeIFD2kiSaTBDZcx:RuxkJTgip2BQ93b8XSImzBOD2TPdcx
  • TLSH
    T13D231B103BE9823BF2BE4BB89CF26145467AF2632603D54D2CC451DB5723FC69A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2