Extracted

• • Target
    4bc796c0ab1ff5edf9e7772d1f62e15df2ab3b6fcf63e37cc069637479e51fd9
  • Size 45KB
  • SHA256 4bc796c0ab1ff5edf9e7772d1f62e15df2ab3b6fcf63e37cc069637479e51fd9
  • MD5 ca4c1dea051e579b7d6a5657dead8897
  • SHA1 492012c5f35ebadb9e528f68dcd9fdee2e669792
  • SHA512 c53bfd5468991773a0ad6e6402ae34a37fcf75dec259bc539a8b9ad5c158843a07e350e0105e9d5969f9b02945f71560b0d54995768296ee74cc8bb4b6e5febb
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1a/qpG3jHuPIgzjbBgXQiGqp3nfdR99Dh2nBDZcx:RuxkJTgip2nIM3g3buXtGqp3f3Dhkdcx
  • TLSH
    T1A9232A003BE9822BF2BE5F78A8F26205467AF2636603D54D2CC451DB5713FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2