Extracted

• • Target
    41e5c3ba4c8d5e56c0abe20690ec7a161c07f2d10c049249350f03d4086ff2f4
  • Size 45KB
  • SHA256 41e5c3ba4c8d5e56c0abe20690ec7a161c07f2d10c049249350f03d4086ff2f4
  • MD5 2f8bafbacfecd0f8adc28c98e1ba8eae
  • SHA1 ea00e896744cdb7dccb0c0828f3cea7f7c59abd1
  • SHA512 44cc21624ee6ad0e242d4d2f3e11115bb8a0ed30dbcb7ecb3374685326a5d2b32fe5e12c8bde195c357edb5a410c074b9f429e42f271578e026f6df49a403e79
  • SSDEEP 768:0uDWZTpw7bmaWUg3gSk0mo2ql4TYmvGTKAPI3zjbogX3iZKYdOwwKHRo8OBDZAx:0uDWZTpMZSB2VvUKl33b/XSZBhwQKjdy
  • TLSH
    T1AC232A003BE9813BF2BE4F7899F25145867AF1A37603D64A1CC441DB5723FC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2