Extracted

• • Target
    4e46a05a655521e6d026163359924a4c20e8cd81894b1d1aa855d3c9c07797d7
  • Size 45KB
  • SHA256 4e46a05a655521e6d026163359924a4c20e8cd81894b1d1aa855d3c9c07797d7
  • MD5 da8058ff04c14efc4ad1d65123ef0656
  • SHA1 f35c1d8ccc86b6318fa57ca8f9405bdde82b49b1
  • SHA512 b79d01a1688b35617dbd000572f7381fa65a5d33d0746fd62d351d82de0e51f0f01dd48672ceef325832c8316e10ec7ff2a7d0ad86d61d3af1c0b9eeef96799f
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1gTo0p54FcPIhzjb1gX3i0uEzwsfrp6wBDZUx:cuR0JTPjY2bTDv4Fhh3bSXS0NPrp6mdW
  • TLSH
    T1DC232A003BE9822BF2BE4F78ADF26145867EF6736603D6491CC4419B5613FC686426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2