Extracted

• • Target
    4c1c5eb91c82af7c4d0623419c5e8ae7f72c9d47736a95ed71745fbf9b644bef
  • Size 45KB
  • SHA256 4c1c5eb91c82af7c4d0623419c5e8ae7f72c9d47736a95ed71745fbf9b644bef
  • MD5 be9ec377fc7906c0ba5d64d1b10c064c
  • SHA1 30cb33f041c5ddc1e7fe0f45068ef8c398b0f5a3
  • SHA512 f2a0ce48a91f9da192b81d87b0703e3e5c50e8143bb605a4ee28fcbe18eddd4440bc25b30db109ea9972807ece7a39d6059a70b838491721115a66761382777e
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYfDEbHBqjSOPI/XzzjbrgX3iBAVdIgX+I5Gy8tBDZ0x:8uuSpTgyf23yoO3/Xz3bUXSBArX+zyIU
  • TLSH
    T192231A0037E8C12BF2BE4F78A9F26145867AF6633603D54D1CC4529B5623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2