Extracted

• • Target
    4c17a5dd87526f6afd0e01fa9565a6cd0dd93cbb19cb825c13e51e8c6c460bee
  • Size 45KB
  • SHA256 4c17a5dd87526f6afd0e01fa9565a6cd0dd93cbb19cb825c13e51e8c6c460bee
  • MD5 34ecc96c58d63cb63cc623bf9ad70176
  • SHA1 9d5d49f86858c0af700d7fb33560bfceafbe9f51
  • SHA512 46fe804f65610d274fbbe520bb7a444b92c53e2e045b644a50d496fa40d49f043649934bdc4e24dc8d01807c5936a5e795c95b4209211cff51a295b32497f714
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVmVlcVl6GcPI+zjbagX3NAth8uwuSEIRBDZEx:MuBGJTPho2nV2X6Gh+3bNX+cgIvdEx
  • TLSH
    T18D232B0037E9823BF2BE4F789DF26146867AF6632603D5491CC441DB5613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2