Extracted

• • Target
    4b72c53e09759e4a69fb3f5efb920e97d32ae91e21f2d72ccfa9a6fe0ce23706
  • Size 45KB
  • SHA256 4b72c53e09759e4a69fb3f5efb920e97d32ae91e21f2d72ccfa9a6fe0ce23706
  • MD5 b1f890fef9e6a5abb31e3297e07d5c2c
  • SHA1 a498a8ed2b1e21b96d0c29dca4f9acc287f5e780
  • SHA512 a581144759ce381fce1915fbcf535dafaad500d3440c2c67094921adf3b6971fbac9910f2a8de087ba20afb1dc083646998edd009449ec091d1e17c5225edce5
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFTlsHoPEaMPIGcjb5gX3it0ckZo2FU4L2pbJaRBDZW:cu7e5TH2A2muuEaxGsbWXSt0ckCYq7C0
  • TLSH
    T1DE231B003BE8822BF2BE4F78ADF26145867BF5632603D54E2CC4519B5613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2