Extracted

• • Target
    4fcd328123c6683e6def8d3da1fd7a1ac0f54bfc664d0fe0dd151b311ad6af37
  • Size 45KB
  • SHA256 4fcd328123c6683e6def8d3da1fd7a1ac0f54bfc664d0fe0dd151b311ad6af37
  • MD5 f74fc9abd1dabd05068f5194785a97bd
  • SHA1 3cdb91de03a047c3218e069b2a0db9381e669764
  • SHA512 bc193a24f620cf9a65a86f17885f59e82f7dbeeead20297ca8fd34bdc59a9f80b3f8a56cfcc4ddb358adb72415e4b6a7811c71c94469501856015012f4114b32
  • SSDEEP 768:ruKQpTA8RXNWU5xFrmo2qre0ewtDc30oiZPI/zjbUgX3iewqpeKYk0uMpOqiKlB0:ruKQpTAOX23wR2iW/3b7XSNwe1DpLi40
  • TLSH
    T1CB233B003BE9812BF2BE4F7459F26245867AF6636603D5491CC441DB5B23FC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2