Extracted

• • Target
    4b4ecaadc5af40c3a658a06ef68c2d131ecb5077b53c7d8509717ce2b3f29831
  • Size 45KB
  • SHA256 4b4ecaadc5af40c3a658a06ef68c2d131ecb5077b53c7d8509717ce2b3f29831
  • MD5 0d129cff8e6676e0739b396983bd5e8b
  • SHA1 80a02c490e0905ab2877afc60ceafc5fb31040d9
  • SHA512 1d8a20e50cfecb9bd979f7a4b6555e65ed147fb29bb53c6c9b98c66cd48c38975f817a25388da394fc2bcc0d531904fe9e8d95d2e4470359b73b00f7a7f4ea43
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFw3HO4SNMOPI0azjbpgo3i3kH8m7OzaaNYVBDZEx:MuLAZTnbg2R+JM30a3bmoS3lcCrNgdEx
  • TLSH
    T1FA2319003BEC812BF2BE4F7898F26145867AF6637603D58A1CC4519B4713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2