Extracted

• • Target
    004c1ead0dc9295ca6421f26589c0e01bfebbe58ca25a78b51dcdca71195ddb8
  • Size 45KB
  • SHA256 004c1ead0dc9295ca6421f26589c0e01bfebbe58ca25a78b51dcdca71195ddb8
  • MD5 cccd9158b22eef4941945d24804eff5a
  • SHA1 8a97cdb7d491784468aaa3a08c4962d172f198d1
  • SHA512 2254e0b7453accbc69ff31b92502f3136ae09aa56a3a66ccccc8d53218de834359689c60925bf65c66c196084e3e5899b7a349c5d36eef776304a167df283450
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNDITnyHaaPIHzjbigX3itZGVZe4XApMJdP6rLBDZ2:5uSy6pTpoo2gE5H3bFXSivJdiRd0x
  • TLSH
    T1FA232B003BE9C227F2BE5F789DF26141867AF5633A03D54D1C84529B5623FC58A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2