Extracted

• • Target
    4b45a96db13412dffaa9007dd970d0745f337c20e0e85c6ed1280c4e8075e759
  • Size 45KB
  • SHA256 4b45a96db13412dffaa9007dd970d0745f337c20e0e85c6ed1280c4e8075e759
  • MD5 ea5d76318fe9150b2aa3c61b0e1d5ae1
  • SHA1 e212ee5b4446c13c561d0bfc63d5021fb590810e
  • SHA512 df6d29d270c0955b04024eac2d4d2316b44d86c838148af006a3e027430d74a86938c0ef732f6494581c2f4c61089e6322ead4ce69623df46d253588416c7034
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwX3Xo5EayPIazjbrgX3i667IQwLt27xBDZMx:ku40ZTXEb2zQEaba3bUXS7HFPdMx
  • TLSH
    T190231B003BE88167F1BE4FB89DF25145867AF5A37603D5492CC442D75723FC68A42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2