Extracted

• • Target
    f026456cca905542c643c99e57e1dd4ff0fdb2857831e80d575331c8c2fee450
  • Size 45KB
  • SHA256 f026456cca905542c643c99e57e1dd4ff0fdb2857831e80d575331c8c2fee450
  • MD5 93da2a37702f53b7b8fe7f8262b3b838
  • SHA1 c514be6cab7961a07ec6ad103c8c152ffc71fa6b
  • SHA512 5fd3dbe28d5f3b9f91b25d052e25df2d0de1cb8ff3addec65c0a64e9f079dfcd9542ce12c7c4d99217b3f3b0bd49cef59f92f2472a1588db7bdb249dba1eba0c
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qV/FpPklON8APIDzjbrgX3iNQZHKlXj7lM0BDZkx:suJdpTPdI227kwN8lD3bUXSNSqZ7lndm
  • TLSH
    T1C22329003BE8813BF27E4F7899F26145467AF6637603D64E1CC442DB5723BC69A42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2