Extracted

• • Target
    4c17c093395fcc866010f1bee3da2c92341fc3cb1a22c44448013faa9f28e6e3
  • Size 45KB
  • SHA256 4c17c093395fcc866010f1bee3da2c92341fc3cb1a22c44448013faa9f28e6e3
  • MD5 20bd983e5f4d9472ce3feff7d11ef073
  • SHA1 992bc202ad4400a2c579d3625b6aba1f81a6a173
  • SHA512 dac8d2ae43c1d57c77d1605d18c4df2a4af30c0ad38646a3b81ff16cd474b1a48e50b8cee86259180c06591d2e4f490f332dc3d9514cce878519f240a7ccdc89
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1Jw0Q+KXPIOzjbNgX3iOg7OLTydCI5BDZUx:cu6YepTPso229O3baXSd7OSndUx
  • TLSH
    T1482319003BE9813AF2BE4FB898F26145857AF6633603D6496CC451DB1B23FC6D6426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2