Extracted

• • Target
    4c22428c1346490d509189e973c754a01d8ab43bde7608faecd0588fc10743b5
  • Size 45KB
  • SHA256 4c22428c1346490d509189e973c754a01d8ab43bde7608faecd0588fc10743b5
  • MD5 c217c77f9bd854c88d09486d05f7465a
  • SHA1 78bbf6e4b9a8cdab1fc768b65918b8a3ce80c699
  • SHA512 cb24b9ac76700bcb6408cbf4874eb7e68ebfe5fb5ea3c00dc1cf903962d06cbe4c8cabb9342c29d7732e72e108a1da22f9775c429cff8d7e376268476b3074c8
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAy+GnnVPJgHuPI4zjbqgX3i9TeKFCPSKR3OBDZcx:UuKWgSJTwRf2i+o0343b9XSJdFCPSKRT
  • TLSH
    T116232B003BE8C22BF2BF5FB868F26145457AF6633603D9491CC451DB5623FC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2