Extracted

• • Target
    f664ee107995c0d077eb210be1bdd5d7f7eadb9648ef1eaac17cbe47ff5dd80a
  • Size 45KB
  • SHA256 f664ee107995c0d077eb210be1bdd5d7f7eadb9648ef1eaac17cbe47ff5dd80a
  • MD5 db5fa36563a2c5d57221b15c2f89f627
  • SHA1 9f631aa43183db53c8fa169d3cdcb139bc53618d
  • SHA512 43fedcd6fe1d4c5b2c922f36e29beabffeb2ba9686e78c8d2551079d6ad3b9e5531ced76c241113337e26c4e9b2a96055c4bcc8744935335bc0474d827c91cea
  • SSDEEP 768:4uBfJTMUyYUWUWBDimo2qVp0ewtDc30oiZPI/zjbYgX3iGi8rUbzeDwV9iS5BDZV:4uBfJTMpv2wwR2iW/3bPXSGi8rU20xdV
  • TLSH
    T166232B003BE9812BF2BE4F78A9F25245467AF2636603D5491CC451DB5B23FC68A439FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2