Extracted

• • Target
    4ab6c6c4f04dfbe31d1a09f6bb941bc3c51d76c085d1228248805dcd52a9a393
  • Size 45KB
  • SHA256 4ab6c6c4f04dfbe31d1a09f6bb941bc3c51d76c085d1228248805dcd52a9a393
  • MD5 73975263dd5421fd4257b84f795e4ed5
  • SHA1 fe34bc756561d59ea0e4e4de28b20fbad1e2b9ea
  • SHA512 a7a265da20dce223eca8fa98139f4c381e108ff4d6fb5728026f85fa8d2186bc6af12ca881a92ce69596f81f84e1367cb0acdb27589f73aaa6fa962b8765f96c
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFJhk6c7OOPInzjbIgz3iMCSPamCFBDZUx:cu7e5TH2A2w6TO3n3bfzSMCSBCLdUx
  • TLSH
    T107232B003BEC822BF2BE4F7899F26145467EF2A37603D54A1CC451DB5613FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2