Extracted

• • Target
    f224b273c053af86e0cb1d121ff021aaa92dffb8ecd16357a93d18082af390f5
  • Size 45KB
  • SHA256 f224b273c053af86e0cb1d121ff021aaa92dffb8ecd16357a93d18082af390f5
  • MD5 4106fda35b0b07538a4a48395601d4e2
  • SHA1 1a04f925b194e543b23ba6668db6f771a3403785
  • SHA512 052f38040e29bf0c57d2103a25bf90334bc9f02c954f1713fbd7e2e1f1b3407b64ac1f7d1b47db9267bc956905d16467bdc4a3450b6b205653226da9728d3811
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQq3xq6YFoOPIUzjbSgp3iPjRrY0V5lJZ0EBIBDZUx:cuqb5TrhG2ekxo3U3bVpSZzVbJZvBudW
  • TLSH
    T111232B003BE8C127F2BE4F789DF261054A7AF6636603D54D1CC4529B4A13FC69A526FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2