Extracted

• • Target
    4cc8ab452c1e310b3c74047260af63759f46b1eab2cf1e1705a977704e6fd40f
  • Size 45KB
  • SHA256 4cc8ab452c1e310b3c74047260af63759f46b1eab2cf1e1705a977704e6fd40f
  • MD5 26eda1ed8fb86b64c3f7876486901014
  • SHA1 b6c312417d3814b8d74aa3e36b5997655ad1af74
  • SHA512 1f8a84cbdad0191aa53624e0a01c1fc38c60d839a5cd9e8d5c3d2251ebdabe5ec34b0628b7a943207c57f06e0159c14c63b43489a4e713aa1fe7f2e68e9e911c
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1V8V1yp7EcPIpzjbCgX3i6r6y2qdgiExvvsM4BDZMx:wuZ8pT1tc2W8V41Ehp3blXS6rvrdMx
  • TLSH
    T1EE232A1037E8822BF2BE4F786DF26145867AF2732603D64A1CC451DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2