Extracted

• • Target
    447670efc4d28cc4d4ed357f5ad2f54236bc40d824ae58636f7147cd279a12e1
  • Size 45KB
  • SHA256 447670efc4d28cc4d4ed357f5ad2f54236bc40d824ae58636f7147cd279a12e1
  • MD5 02b634089527a93bb42039b3855cfa4b
  • SHA1 8039b91e0574534b97bc791b3156e832a44c5c5e
  • SHA512 cb8f15be5762bcc5c665b64c2c98bdfa1b251671435f8658a2fd22f969d355362e5bf9eeed3bc1cb89f14c2215879fbcd532991b26ba12ecf6c6a27815ba3b1c
  • SSDEEP 768:7uCIJTQc5fVWUhxlDmo2qr7b3/GYjHuPInzjb/gXUiwLftmHq9GB9BDZkx:7uCIJTQmX2wL/3n3bIXxwJBoTdkx
  • TLSH
    T160232B103BE9812BF2BE4FB49DF26105467AF6736603D6491CC451DB4623FC28A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2