Extracted

• • Target
    4becfbc05ae69eb1e1e18f0b3d507c3e79221cc8ebe0bb0314ebb77a3df46537
  • Size 45KB
  • SHA256 4becfbc05ae69eb1e1e18f0b3d507c3e79221cc8ebe0bb0314ebb77a3df46537
  • MD5 c6be79fbe9c3637c677eb0ffc3928382
  • SHA1 d4347df9ddebfcc21b1b6960677bc26690c389c0
  • SHA512 fb49d8d1e647d529e77aa6369183d8b032b52c80e654ff15078157984dc8869cfa748b2a0a391d9b9ff0a5bd55e5f526c50b0c666ee19ba1e3f959d7d5a6f9a3
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyLiE0yFjrdj3kk8PIhijbXgX3iAwR6ezlcBDZEx:MuBGJTPho2/LBXDBhubwXSb6ep6dEx
  • TLSH
    T12D23080037E9812BF2BE4F7869F26145467AF6632603D64E1CC451DB5723FC68A43AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2