Extracted

• • Target
    4e02bdfd6c13b49e7551cd5ae78a8aa8979775ae164ccb7f9b74fb4619b8aed3
  • Size 45KB
  • SHA256 4e02bdfd6c13b49e7551cd5ae78a8aa8979775ae164ccb7f9b74fb4619b8aed3
  • MD5 cdc59c2a1c5e0f6d635406a74b49c321
  • SHA1 42e2a2c586944d66dcddd971d76f7339e909be45
  • SHA512 62853f9a9291fa5c85954e6b1874a66185152ed921ac1f6e69daa86f4f00e27a745fb8ef9b6710942ed6550aad1d6e5c6362522c35ec382a9343e199ebcd30fb
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9OoopCBK9INJPIZzjbYgX3imOy3FdIkVp1X6BDZsx:EufspTf2g2bo6bIwZ3bPXSmT3DIdsx
  • TLSH
    T126231A0037E8C12BF1BE4F78A8F25145867AF6637603E54E2CC4529B5613BC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2