Extracted

• • Target
    4899f6ab60440a90a865c6d09c8f181eea24487d3712aefbe104670779513045
  • Size 45KB
  • SHA256 4899f6ab60440a90a865c6d09c8f181eea24487d3712aefbe104670779513045
  • MD5 3fd21aef1b86325f661683eb2258cf69
  • SHA1 b45be963532f43ea9742e9a12effeb73996a50bf
  • SHA512 bc987e4b020744d1a8137284c99a7cc3c8b17a70b5c188a16ce0e4a76bd0fab8310b220998e041282ca10aebdd7de8f4a76e14da496e09681249931c28e23301
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4D9wSkq/z1OPIozjbkgr3iLqvHBvpHimSnwBDZ0x:8uUIpT4vAj2HiVK3o3brrSEBvpH1Kmd2
  • TLSH
    T1D3233B0037E9C12BF2BF5F7899F26145867AF2633503D64A1CC412975623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2