Extracted

• • Target
    fa39b2ebe55a2364ce5814e3c9b6549aa8df265df9537cfdadddc224219a42c9
  • Size 45KB
  • SHA256 fa39b2ebe55a2364ce5814e3c9b6549aa8df265df9537cfdadddc224219a42c9
  • MD5 19ca3833b1d6b35108b66acf1e6c6554
  • SHA1 0a6f505fcf0f6c845fad041c5b97a309d2a54053
  • SHA512 9674f2cb7d021727ec3fd6a42504bc313bfc099120498a800f3c142bab48e2273e90a8bed48d64f2a3f3bae43603dc1b9c9611d3dcb6c417b37c23a0fe777514
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1SVkIpeUGcPIxzjbEgX3cxImDbHpwXrBDZUx:cuR0JTPjY2rVL4UGhx3bLXsxX/H09dUx
  • TLSH
    T1AE233A0037E9822BF2BE4F789DF26145867AF6633603D64A1CC4519B5713FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2