Extracted

• • Target
    4c87278d41766717f5497bf869c74ab818fc4576d12c58fb337b3dfd527108ae
  • Size 45KB
  • SHA256 4c87278d41766717f5497bf869c74ab818fc4576d12c58fb337b3dfd527108ae
  • MD5 eb2c0617687c410d73714cb51a5dd327
  • SHA1 794b2807f41d78870ca253f8fd89d1487ef9b7f5
  • SHA512 3fe1a528e19b071dba7672b1a0a92b9e3debe275a379260f829f9d9f96d9f9ffdfd5070c45fadc3a4a15b57008316c7b8f845f5d1c74219e52754d0667469f18
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q112q0CCMPd4CvS8PImCjbHgX3iWlTG6tIB7BDZMx:wuZ8pT1tc2MRCEWBmObAXSWlTG6tCtdO
  • TLSH
    T1DF231A0037D88127F2BE5F7859F26145867AF2636A03D94E1CC451DB5B23FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2