Extracted

• • Target
    4863debef04fbc5de8c3c7536be4de31dd06b23505ec375e30018fcc570ad1ce
  • Size 45KB
  • SHA256 4863debef04fbc5de8c3c7536be4de31dd06b23505ec375e30018fcc570ad1ce
  • MD5 ad9e8d08a976671b1a420ef90ef64a84
  • SHA1 72fbd8cd4c3d694805e5bfbeb668497819699a77
  • SHA512 406c0b00f2646db965d255b6432945e7f8f4e1304ff59547ffb34e09e6743853caf183d9af2245c678e4134673cda0b1e37dada5c47506dc5c56d3e930413ad4
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVhxJaxMwHuPIvzjbdgc3i80+O8pZLBDZkx:suJdpTPdI2IeN3v3bKcSB+O6Zddkx
  • TLSH
    T19B231A003BE8C12BF2BE4FB8A8F26145467AF6672603D64D2CC451DB5723FC58A526ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2