Extracted

• • Target
    c4c69a8cfd842da5cdb91713a7bd5bacf2e0d0bc7fd71b831ad51a60f56c350a
  • Size 45KB
  • SHA256 c4c69a8cfd842da5cdb91713a7bd5bacf2e0d0bc7fd71b831ad51a60f56c350a
  • MD5 49279c3874ddb4b25e09db4f4f5bba9a
  • SHA1 4976555817e2b945899bf3a8ac0d6a41e7f50395
  • SHA512 ffdc94bf35b9f0007643c264f068940ebd17011a2f839fc85687fc18d0a446751563497891c9649ef30e6f72e9ace560d1b965f496e1db7aff0273da9adbd4b9
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9aCSwTMSPI5ujb3gX3i2+/C1aDQBDZ8x:0u1YJTHcw2NgG5CbQXSM1Fd8x
  • TLSH
    T199233C003BE8822BF2BE4F7899F26145867AF6673603D5891CC451DB5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2