Extracted

• • Target
    fb2c8f6b6aa252be8c22c2c058aa983cfc19f9625e4ab95e2003f570e936bb9e
  • Size 45KB
  • SHA256 fb2c8f6b6aa252be8c22c2c058aa983cfc19f9625e4ab95e2003f570e936bb9e
  • MD5 34374f5e91b72fdb7c179e89436447de
  • SHA1 09950a6ca0af416884a0c3d2ddc2b63b26f03cc0
  • SHA512 5320dd7ce68bb8222f463926ce2852794fe140a2927d18dcf898a09a1a28f68f7d3affb9dedb5c48cc9c2cd7bbfc61346ce945e13eed5930b5fefa64bbca7c61
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1Jw0QUKXPItzjb8gX3itcMNRMKPLBDZUx:cu6YepTPso22ft3bTXSacdUx
  • TLSH
    T172231B003BE9813BF2BE4FB898F26145857AE6633603D54D2CC452DB5623FC6CA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2