Extracted

• • Target
    a4499544cfa5b9a5adf45c842b42009cb7c2a6e0eff6546fa69674c4a69c51c2
  • Size 45KB
  • SHA256 a4499544cfa5b9a5adf45c842b42009cb7c2a6e0eff6546fa69674c4a69c51c2
  • MD5 db499339d4ad2c965bca4e2e656fb944
  • SHA1 eaca19920dd7016d8115f6144f6053258d44a575
  • SHA512 28004ac5de2caa3c1d11d4079483fa2ea7626de5a5ab66db1c001af56c1bbc30859d212a8e13e986c1f6a0b805497e69231872045d5658e669b57ffb1ac296a7
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwnUJ+XOoJ9hU/NPIEfzjbngX3iM0pONleCBDZMx:ku40ZTXEb2bU0eI9hyqEf3bgXSM0GbdO
  • TLSH
    T135232B003BE9C12BF2BE4FB899F26145867AF2632603D54A1CC451DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2