Extracted

• • Target
    4d3b31f933754a8c439385bfbed33677f59b38177849d5c13dca9966e0887d6b
  • Size 45KB
  • SHA256 4d3b31f933754a8c439385bfbed33677f59b38177849d5c13dca9966e0887d6b
  • MD5 29581840ef76e530ea385a622f871b2b
  • SHA1 e93ad53407effd38e54ea092ea3556f4e88de733
  • SHA512 f3c0f24c240263cf5b3fc8c51bfe59f9837d72a5c9025d6258879027f2b20c0b9f66aef041f25ffafa8070e61bf64b9616658e12a9b88db9368322ab30f60ac8
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9r9wSkq/z1OPIozjbBg43iA+84Q+taiHk8BDZsx:EufspTf2g2miVK3o3bu4SAh4ptaakadu
  • TLSH
    T19A233A003BE9C12BF2BE4F7859F26145867AF2733603D64A1CC451DB5623BC58A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2