Extracted

• • Target
    a4f3bd66ccef04509556d4a98159e460b686f61cb490730a406c0afef9a8061f
  • Size 45KB
  • SHA256 a4f3bd66ccef04509556d4a98159e460b686f61cb490730a406c0afef9a8061f
  • MD5 35776bd13ec6b37c30ef84ada35cdcc2
  • SHA1 ae39ae7175faeb11767acab2e78904e890c5eaa8
  • SHA512 4c2a4a4a15d3c7d63ee224696c1d872fa414e9b53dec0ee2feb4227ace2e0dfc044332654071ffe4aef037590fd99fdda66c868c7fdcf133aefd3369963e0a0a
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVigzZUpx7PI8xjb2gX3irLioAiIvuOIkuf9dBDZkx:suJdpTPdI2Ton8hbpXSrLioAiIu9Bdkx
  • TLSH
    T111232B003BE8C127F2BE4F78ACF26145867AF6637603D64D2CC451DB5623BC68A526F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2