Extracted

• • Target
    de0c4f4a31eb3ef29f05428511af40e6cc84684c8cabaa1081a08d77a8216b41
  • Size 45KB
  • SHA256 de0c4f4a31eb3ef29f05428511af40e6cc84684c8cabaa1081a08d77a8216b41
  • MD5 6f3fb049f7d09f6646a1293838af909f
  • SHA1 a4db2aa26eaadcdbbad4e4e41e9e955c5fc816e6
  • SHA512 71d5755181647d86cebfa4b57c0d31e749479d98d466db6a5f204764a39b39658beb0b83da5ba37ce70a6e87e552f7d9cdd800e190571ea38e4921365e89e084
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF4ZTohEaSPIRzjbCgX3iCeuNrHNFsRp1BDZUx:cu7e5TH2A214Ea7R3blXSCesNF+FdUx
  • TLSH
    T1FA232B003BE8C12BF2BE4F7899F26145867AF6632603D58A1CC451D75613FC6DA42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2