Extracted

• • Target
    fa08cd6b88fc2acbe7a7ac3002f5cf3f17ad128b808eeb4be4590524cdd9dc21
  • Size 45KB
  • SHA256 fa08cd6b88fc2acbe7a7ac3002f5cf3f17ad128b808eeb4be4590524cdd9dc21
  • MD5 34d01b5fb3e364e102c917cfc7d06fc7
  • SHA1 5b4f185a2181084db862fcbacd8dd95dd0c40c0c
  • SHA512 eda1e12fbd5b31a2690b0b7268d4cc0acf48913254fb82f21cd4c46dff08c94696a2d97945d5297959c72e84befcf28bb33865303ad19b367132f1cdc223e7be
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9L9YSkq/zNOPIFzjbAg33i/AAFtSGLcL+BDZsx:EufspTf2g2maVC3F3bn3S/PYMdsx
  • TLSH
    T11B232B003BE9C12BF2BE4F7899F26145867AE2633603D64A1CC451DB5723FC68A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2