Extracted

• • Target
    4c15c32195da6c7705dd189b6108abe2b52c6c0eba67d842e574ba18ecf8a406
  • Size 45KB
  • SHA256 4c15c32195da6c7705dd189b6108abe2b52c6c0eba67d842e574ba18ecf8a406
  • MD5 7531fdd43b35b9632ed16a5b52a2242c
  • SHA1 64f2c367deaae68d7bdb9efe85630d15179e230f
  • SHA512 2ee939446f530cb218640c967ccae60a9c21f0fb02fe5f67949ce34bf81f437abe153f1d21095d925578d8d29302997e76af0328413106ad29f1f00e994bff16
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVbxGQG9PHuPIczjbZgw3ivzXAIYFGj9gBI3v+bjBDZm:suJdpTPdI2eHC3c3b2wS0PFGj9gBI/Oa
  • TLSH
    T1ED233B003BE8812BF2BF4FB859F26145867AF2637603D64D2CC451D75613FC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2