Extracted

• • Target
    4f3b4890171a435029982da283d05800a5395cb6c2a6185c816a840186194fc3
  • Size 45KB
  • SHA256 4f3b4890171a435029982da283d05800a5395cb6c2a6185c816a840186194fc3
  • MD5 1eb5e63a7dc630d5f3284d55c20219a5
  • SHA1 0c3f110fe227239fa674984a6a234829b687636e
  • SHA512 d6a0fc93c9c43008a40023ff69a8706d3c9c4d14be3bf2768a5b6bef53ce6b0decd9e8961282d7eb7e41651494b433140f1a96a30287e52ca837bd7b763494d7
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9x/NYssPJZOPIczzjbbgXeiLuvUZrHW86wgBDZsx:EulCJTHl42eHIf3cz3bkXnLHZr286Jdu
  • TLSH
    T1D5232A0037E8812BF2BE4F78A8F26145867AF6673603D58E1CC451DB4613BC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2