Extracted

• • Target
    4784c999d44567d81af1f4b02f34ef3c00457b9f55d6e2d32c7139bdc1b9c63f
  • Size 45KB
  • SHA256 4784c999d44567d81af1f4b02f34ef3c00457b9f55d6e2d32c7139bdc1b9c63f
  • MD5 fec554607d228c71c06e62be922c63cc
  • SHA1 664992de7f89dc3beea63b31c5fda33ae3b77627
  • SHA512 16de135afa826aad269778a48ec3611341a9ab6ab967bc6a891f4c31357d2234f8a59df918a949cf9caf3937770a637f45a2bd60d46c3cf605978d33ac7179ec
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAjT2Qpm7PIKEjbjgX3iDlQLgGYZlskkvTkg1BDZcx:UuKWgSJTwRf2GeKEb8XS6kqvlbdcx
  • TLSH
    T10C232A003BE8812AF1BE5BB8ADF26145867AF5733603D54D2CC451DB5623FC286426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2