Extracted

• • Target
    d4246f377e71940680d0d06dff66a0e0a105aa0ccbf6fe8f6074b1b34e2b8344
  • Size 45KB
  • SHA256 d4246f377e71940680d0d06dff66a0e0a105aa0ccbf6fe8f6074b1b34e2b8344
  • MD5 76ca645c2373707d0294c6d217dd614e
  • SHA1 16b055f1665f38e2c45452050706219f26368be3
  • SHA512 48a67e3386ee28d195f5f417c69d7c4a835fa18c8112f6d55784e81ab02b8a2fdded2c1f06a063afb927bd2a3655478abdb8f421f5cfe690ead402b9d32b37ec
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1s3wZQaKkPIfzjbWgX3iCtcwYLV3K5LBDZUx:cu6YepTPso2QIf3bJXSCtgV3K5ddUx
  • TLSH
    T158231A003BE88236F2BE4FB89DF26145867AF5632603DA4D2CC451D75723BC6CA526ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2