Extracted

• • Target
    44b4a491f23df498c8e76d00d757603e3253b5fb2a1f692131c4813fd2d68dd8
  • Size 45KB
  • SHA256 44b4a491f23df498c8e76d00d757603e3253b5fb2a1f692131c4813fd2d68dd8
  • MD5 c40eb2574ede8209ced2efd2ad56e8f2
  • SHA1 4691c94b9e8ca24840d4cd0bf9fc35d25c8f7236
  • SHA512 4af4e7cc924b117419ec76fec417857c71d432314722d06f17f3531b30cc7ed1f12366507618f225922fe057b4af2a51247ff64353198fe46334e7b837635f98
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFHBlte40WMOPI0IzjbjgXIiXTZ4uNIED6BDZEx:MuLAZTnbg202UM30I3b8XFXTZB7odEx
  • TLSH
    T17E232A003BE8812BF2BE4F78A8F26145867AF6677603D64A1CC451D74713FC6CA526FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2