Extracted

• • Target
    444fb5a92d60d46e0e8ac0d845891190e4be2bc355c62c0c57bcab61b2cf270c
  • Size 45KB
  • SHA256 444fb5a92d60d46e0e8ac0d845891190e4be2bc355c62c0c57bcab61b2cf270c
  • MD5 f04377cf45798490b60eff697d477948
  • SHA1 9efc628a5accc1c007badca1be2eb38ffd927fbd
  • SHA512 21c6725030592b5166f25e2ddcbf518a84a1b7480e3b829cfcd5b7c058003b4cfcb259232b32716c57100e4b4944b3567d3f7104f383af79bdd7b43bb2e457c3
  • SSDEEP 768:Iu5KkpTsU6Q8WU+xjamo2q1eT9Qpm9PI5zjbngX3i6MvGZUErLHUjgr7uFBDZLx:Iu5KkpTsx/2pQ53bgXSeZJLHQgryLdLx
  • TLSH
    T1D1231A003BD8823BF2BE5FB89CF26145857AF2632603D6492CC4519B5623FC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2