Extracted

• • Target
    41abe0f8b2f74f71eeed255961a2f09bbbfcaf86084cd8451e9f7270d26d7557
  • Size 45KB
  • SHA256 41abe0f8b2f74f71eeed255961a2f09bbbfcaf86084cd8451e9f7270d26d7557
  • MD5 f8cb7f9b00570ce6b1fcfb44749dd539
  • SHA1 6c4ac6e681b3de29df26c8947e7611cc46ae58d3
  • SHA512 21c4f4815a487bde03a996fa3178b835ae94709b6b6dd37a6dfd98a222108bc7ca2c3ce93039e428d33bb051cc60d589bad60ce56dfdb1dd713ab3aeda422b7f
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qViqyx0OFUwdrxIkDPIDzjbRgX3iBO6bzd5rFBDMdSw:MuBGJTPho2fqKTNMD3beXSBtfd5J8udG
  • TLSH
    T145233B0037E9812BF6BE4F74A8F26145867AF6732603D64D1CC451DB5B23BC68642AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2