Extracted

• • Target
    faad4f023c88343dc21a89f676a6f216a56aea0cb24f82e0e5ffa3473abb9398
  • Size 45KB
  • SHA256 faad4f023c88343dc21a89f676a6f216a56aea0cb24f82e0e5ffa3473abb9398
  • MD5 1591839835aff71c3c1e929368b3aa66
  • SHA1 b3a01d5a90c656a35ae7be07ae5b921054f3714c
  • SHA512 1d03d35c0ca9c1d5e804e48e69b10ef9bfd06e24887624c17534a3397efe6ea76af1aa7699272ace74c690c65e59401351f04fd1c72579a4053583d70393de86
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFo3xY6aZOOPIgzjbrga3iA3ta4KBDZEx:MuLAZTnbg2Ru/O3g3bUaSA3EdEx
  • TLSH
    T1FA233C003BE8822BF2BE4F74ACF26145867AF6736603D64E1CC451975613FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2