Extracted

• • Target
    41d0872f87c7341dba0e6d28d683dd944803131b5e64b10a00cd3696b59c954a
  • Size 45KB
  • SHA256 41d0872f87c7341dba0e6d28d683dd944803131b5e64b10a00cd3696b59c954a
  • MD5 ab8ad7cc9beb356458238e8a85a19c04
  • SHA1 b118a6db2aabf462e00b6911466b9c3c75e72025
  • SHA512 444da9e9e7722d2fedaad538a14c13acbb6009d96eeb8c1a1f15b89e5fb3155865e98f562234532f4b05ae67516685c2c8dd9758b027f5420ca3339836b125c6
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9KS7synzuOPIzzjbIgXbi7DfYdFKfe2DTtkszBDZ8x:0uPrpT/qY2HSYh3z3bfX22FibTtPd8x
  • TLSH
    T195233C003BE9812BF2BE4F786DF26145867AF5633603D6491CC451DB5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2