Extracted

• • Target
    4c1143f998f57725d749b3e5f92e1ec772ed16225971a9c88a2d28942262285c
  • Size 45KB
  • SHA256 4c1143f998f57725d749b3e5f92e1ec772ed16225971a9c88a2d28942262285c
  • MD5 47e9892e32ef70d47a3a0b614d2e7316
  • SHA1 62c11ddabb2b11e7f632bd22157a54e3688607c4
  • SHA512 d45710ba3c0b3d253ea6d3bb7c82fd92aab260271a3263dc07c93fb2d661d40b411faf21d842438543b29c1862180bd621733c40ce1dfdf64d13d4f3242435df
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1aqJaxjwHuPIPzjbfg43i9ZMwzUCxZh4BDZcx:RuxkJTgip2f3+3P3bo4S9ZEEZYdcx
  • TLSH
    T10B232B103BE9822BF2BE4F7858F26145467AF6672603D64D2CC442DB5623FC6CA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2