Extracted

• • Target
    409bfa66b8df409e98ba860f8fcc703b85aa15d7945e4446506748d765f07094
  • Size 45KB
  • SHA256 409bfa66b8df409e98ba860f8fcc703b85aa15d7945e4446506748d765f07094
  • MD5 d3e9773af51149658c020edcce9942b9
  • SHA1 d1d0a95c01ddb112ab73342be95d32e0a68c0494
  • SHA512 18e8d70e0e2f5c52e5d8f364d13ea1208c356510ea77f0d3de9c16cd2f510356bf967c1c63b0232dc83da00af81456bd2efae50eec29bd7bc8a2eab18adea1f7
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVPmaPol53APIkzjbFgX3iLcHbnk2BgbBDZkx:suJdpTPdI2efob3lk3bCXSLc7n2Ndkx
  • TLSH
    T180232A003BE8813BF2BF4F7499F26145867AF6637603D64A1CC452DB5623FC29A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2