Extracted

• • Target
    fe2b3a9e50f0640fc7f9c55fd8c79272f0fce22a0c4f4ac879f977afbbb395a6
  • Size 45KB
  • SHA256 fe2b3a9e50f0640fc7f9c55fd8c79272f0fce22a0c4f4ac879f977afbbb395a6
  • MD5 02800d2a743e1ff2d84f201bf0b6b8cf
  • SHA1 8c0fec8dcbf09ae259dbc52ddf1f9d7848b8fee2
  • SHA512 8581dc919f389cbda2291d3cde48e72ee862a5de3b6a86cf6af64f73a6fcf47285967051ed08402c1257d2f787e401ce5441404c05f215062ff2072c3342b3e9
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qj4ozHyvCKPIiujbXgX3iZ9+71fMJ/OPbk+dAgYBDZ+:0u2vpTDe+22L5iCbwXSXSS/ODk+dAgeM
  • TLSH
    T1F6231B0037E8C12BF2BE5F749DF26105867AF6633A03D5891CC412DB5613BC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2