Extracted

• • Target
    fd365f9d33c9bef54cbbf3d73492c36337b359516c008a8ab320b2ee37b37a83
  • Size 45KB
  • SHA256 fd365f9d33c9bef54cbbf3d73492c36337b359516c008a8ab320b2ee37b37a83
  • MD5 7a2961f7a69673602dc188aa34e3b071
  • SHA1 a82c0b6863e1353bf4b80fd2d7e19f58918db2f7
  • SHA512 5a7f7716fbc1dbf7af31fc12115a9410b98984141b715cdb024b6f18618ba1892dfcf67f6a1de8a2ba45db120bf400517a2ce90723b6c6df3315d47cc88cec7d
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4UzjHynaKPIswjbXgX3iKqx4VRTX3aBDZ0x:8uUIpT4vAj2wnZs4bwXSKqgEd0x
  • TLSH
    T16F232B003BE9C127F2BE4F78ADF26145867AF5633A03D6891CC411DB1613BC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2