Extracted

• • Target
    468d4866a6b6fbb512eb0ea515793bc719fae1613d356b3e24ac513f79621a9e
  • Size 45KB
  • SHA256 468d4866a6b6fbb512eb0ea515793bc719fae1613d356b3e24ac513f79621a9e
  • MD5 c0048b676c9e0a76446295c385c4ac30
  • SHA1 29807491352dc9a298b59e162a9c05d4e89d42fc
  • SHA512 34fcb44d7322a8297b1ccebc38cd8a201c9ef8292b8a213db883310cb07fece794b9ce0ec730aeb266c31c28b05ad6dce3e2970e3dd7f4edef20d11c9f13ef1d
  • SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7f8EbHBSj2OPI/wzjb5gX3i3mtgmSv/FtV5pcb9Nk:0ushJTDXgH2yBwK3/w3bWXS3mS/FtVMU
  • TLSH
    T19A230A003BE8812BF2BE4F78A8F26145867AB6633603D64A1CC451D75713FC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2