Extracted

• • Target
    4e95f4464f6d49ef6b5f4b9e433346b2b5863e01c7b646a7dfcf756de309832a
  • Size 45KB
  • SHA256 4e95f4464f6d49ef6b5f4b9e433346b2b5863e01c7b646a7dfcf756de309832a
  • MD5 c5cfe62cab6c3030658d8c4840b0f909
  • SHA1 88972bcbe420ee1026200de78bfcf696b2a07786
  • SHA512 71369f5dacb387bcdb57b44a75e0ec7c472e0ed4f7286eea883d8f6f31d5fa194bd988da1789a616cd345a5c5d77caf4a1a08d60f271b5c6e2eb0488ec697a35
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9OoopCBK9INJPIZzjbWgX3iLywutzYa3sJYWNKTd3O:EufspTf2g2bo6bIwZ3bJXSLEZYa3sJzh
  • TLSH
    T17E2329003BE8C12BF2BE5F78A9F25145867AF2636603E5491CC451DB5B13FC68642AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2