Extracted

• • Target
    fafd3ce0b44ef1d2056b81d33fe39ae164c60a6a3dc8918c18bd037d4c998dd2
  • Size 45KB
  • SHA256 fafd3ce0b44ef1d2056b81d33fe39ae164c60a6a3dc8918c18bd037d4c998dd2
  • MD5 1292e14da8d07d3b67d83b4f7634e83d
  • SHA1 be13ed90dd6f5f62d28a36498b651d8fc2f07cec
  • SHA512 1405f32fdaa1e6177760b3d95d79bab95f5db6319a19c950be1c868b6a9d9ba6c681be85fa1bd65054fb86e894e4b4f8ab62a16883950fc3fc26c5d715a036a7
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVLGsGx8OHuPI2zjbpgI3iyk6x8tyuF74apjBDZkx:suJdpTPdI2mez323bmIS7s8su54kldkx
  • TLSH
    T1FD232B0037E8822BF2BE5F7898F26145467AF6637603D54D2CC452DB5623FC69A026FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2