Extracted

• • Target
    42b4e3a1b1224c9136f15f9c0ed8e7778610d500413d8a34170fd2db06ce880d
  • Size 45KB
  • SHA256 42b4e3a1b1224c9136f15f9c0ed8e7778610d500413d8a34170fd2db06ce880d
  • MD5 72bae3a99132da2645dd426bd3b90a05
  • SHA1 6a97e6ac12d1fb79c5d805153c80856bf4954b73
  • SHA512 acef5fe22c8e4a90a32b604ce171e85427af2b76c8b8d48e88b2657d166581f71cca30d9ff4a6cd3d78f1c34d754b9f13c3ed2f51e73ee26099efd0c7d458706
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAAxJaxMwHuPIvzjb3gG3i2X00EAsK5yngAvBDZcx:UuKWgSJTwRf2QeN3v3bQGS2X2x/Bdcx
  • TLSH
    T15C231A003BE88127F2BE4FB859F26145467AF6637603D68D2CC452DB5623FC6CA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2