Extracted

• • Target
    4f8e80f0542deb6e0a194a2a767c0a12cbcb645fba9ab06c4c83876be917f60c
  • Size 45KB
  • SHA256 4f8e80f0542deb6e0a194a2a767c0a12cbcb645fba9ab06c4c83876be917f60c
  • MD5 e0bfbc3b1392b5e1e9ddc169a135df44
  • SHA1 c5a71e4a452d36dd1f116492de2ef1b0ab27c799
  • SHA512 c33ff95b4546ac03be364c91c36b0c2818f0042aaa9b479c6a1be82040df747d5f99f7530ed3f801cbcaaa64aa2a49d3ba4dbf5702ed37e7193db7a78d0ede79
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlneeXKGoibbb6tN8/nPI6DzjbfgX3iYwPrj56HSn:wuDWZTpMZSB2DeDqtNKA6D3boXS1Tjxn
  • TLSH
    T185231A003BE9C22BF2BF4F789DF261458A7AE2632503D54A1CC4519B5713FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2