Extracted

• • Target
    41b73da3fd8d2caa4811dc3dbf293767acfbd7ba664dfcd29f0fb982921fa317
  • Size 45KB
  • SHA256 41b73da3fd8d2caa4811dc3dbf293767acfbd7ba664dfcd29f0fb982921fa317
  • MD5 1bc78e99598d81c241e0ab8128d1cb09
  • SHA1 4de98dce397bfd5d1deff7187b3f3bec80a277f8
  • SHA512 4f8c66d6108186e72008184bc3ca4d9e568cb79badbd8404adacf064c491a4dc3fd4ad0e4e50798376cb4ae1adc12d052a528f6f7e11221ad2273e1073df7c1b
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9FO5QPCBAPSNjPIRzjbpgX3it1Rqw6N1UU1OBDZ8x:0uPrpT/qY2UO5svSKR3bmXSt1dG+U1AM
  • TLSH
    T1F5233B003BE9C12BF2BE4F789CF26145867AF2637603D54E1CC451DB5613BC69A42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2