Extracted

• • Target
    4c8da37961ebcf548feec05642e14424311b5dd0febe70510354cb6907c608a9
  • Size 45KB
  • SHA256 4c8da37961ebcf548feec05642e14424311b5dd0febe70510354cb6907c608a9
  • MD5 aa4ff061bb3c80a1515ef92b4095e1c3
  • SHA1 37fc8fcaaf0f59454c9e5b8f4996d453e94806f3
  • SHA512 9cd768919210c8e62b524fd1ac91d9182db485494e9ca65f6948a966b596b017fd626314fde58d6ee84c4b6f1398340e0ac26e7344577c07d464721989cddd67
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAvT9Qpm9PIOzjbcgX3iYk7S5R7hzzA9eh3BDZcx:UuKWgSJTwRf2hQO3bzXSYk7S5v3dcx
  • TLSH
    T1372319003BE8823BF2BE4FB868F25145867AF5632603D9496CC451DB5723BC686426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2