Extracted

• • Target
    4f4886f6949c31d31462e3d6909f68460194e9b7c3144225ce475750f85765f4
  • Size 45KB
  • SHA256 4f4886f6949c31d31462e3d6909f68460194e9b7c3144225ce475750f85765f4
  • MD5 44ddb533cd1c46c61758bdef165a4840
  • SHA1 d0f3088dde9ee1976855bd230309029e1ebd185a
  • SHA512 028b998db729c10a3b0d63d7ab981c12da02fbce8fc278098833f2413b5c99a648826bf37235abc8e3db2ab515df67ae1628caa8811ebd82716d0677cc979fbf
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1FDusMV16ZcPI/zjbkgX3GGUVvNHcaAWUSXBDZUx:cuR0JTPjY2aDun/6Zh/3brX2G08adHdW
  • TLSH
    T128231B003BE8812BF2BE4F78ADF26145867AF6632603D5491CC451DB5623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2