Extracted

• • Target
    02d22cb078bfb757c90ec4c63af7c01fe89b73099fb5585e72308587209b09c6
  • Size 45KB
  • SHA256 02d22cb078bfb757c90ec4c63af7c01fe89b73099fb5585e72308587209b09c6
  • MD5 1f51a04195ebb810201ae9ab846b8ebf
  • SHA1 9b88d7cbefafb6622d1270f10706d316f53f3898
  • SHA512 ca8c0dcde221ff376cdabca7b4a35e28a929bc53eaecf6224be4579f4aa74ba73882e671fdd7a7046d360ac9262d3d1e90cc5f64561ed34cb2038f31914f9176
  • SSDEEP 768:FuxkJTVmU5EkWUGMKSmo2q1v0UwPOlehAPITpzjbqgX3iat9mINLDJ+1IQ+zpBDs:FuxkJTgip2G0/OghlTp3b9XSauIN/J+P
  • TLSH
    T131232A003BE9822BF2BE4F7899F26105867AF2637603D6491CC451DB5723FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2