Extracted

• • Target
    4f84998601aaf611a9d435024d5b9b055da5406cc13705eb556c685ae065d8b1
  • Size 45KB
  • SHA256 4f84998601aaf611a9d435024d5b9b055da5406cc13705eb556c685ae065d8b1
  • MD5 115140be44ffdc3bfebeb9db4c1e13b3
  • SHA1 3533c59c01e4ef4d486b02b3bb2f4cc9a205b7ac
  • SHA512 dd12c4020a2c77dcc03dc6e3bc8d2d288acde272098ef51da1ed31f04f6d24aaabd290875519d3bdab20489b2117b860ccb355773fdb2f96d15bcf526c2ab0c4
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYh6R8aI6OPIXzjbYgP3iWV1vrobhf6/2iBDZ0x:8uuSpTgyf2J+Fb3X3bPPSWXvroE7d0x
  • TLSH
    T1A8232B003BE8822BF2BE4F7898F26145457EF6637603D58A1CC451DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2