Extracted

• • Target
    f10c391e2f296ba1709ecc9a330041f90d7800f2d41848889866e5abfc41088a
  • Size 45KB
  • SHA256 f10c391e2f296ba1709ecc9a330041f90d7800f2d41848889866e5abfc41088a
  • MD5 aaf3e5ee1ce2c25965468a9d6c15a406
  • SHA1 4730dfd5fa3e31a444d8b1e418c32dc1c605dbe0
  • SHA512 7c1a22f3a9535c7306ff181fbe76b80f0cb3ad3fb319627e6155f1d48b9c8105f5613129bf86f54e592797fe4364352ede79b3a3bb94671f28154982190e187d
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9ah5BewwbOPIMQzjbtgXgiqUo1g/gRsjXWrWBDZsx:EulCJTHl4219F23MQ3b6XdHI2rWUdsx
  • TLSH
    T1C3231A003BE9812BF2BE4F78A8E26145867EB6633603D5891CC451DB5613FC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2