Extracted

• • Target
    4301e4820d105c649246008323440bf45b804685d74e4f2b928bd2a1013594d8
  • Size 45KB
  • SHA256 4301e4820d105c649246008323440bf45b804685d74e4f2b928bd2a1013594d8
  • MD5 a8b344fc567d1fbbe01a1d3767a556c6
  • SHA1 5654228768f13a15d9528f8930db911b2c8f5f77
  • SHA512 76b9ed1792ea7f9068757a82e239cee7ad1693e756c053ef7d05492da3a46cc9225ac1fdf17b079c5f1e96404476feff30b1f11b9ee2016ac442ce1698fb1852
  • SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qFd3HO4SNMOPI0azjbAgv3ijWVz0xDFBDZbx:4uLZZTUTn2k+JM30a3bnvSjW50xndbx
  • TLSH
    T1ED232B003BE88127F2BF4F7869F26145867AF2773603D68E1CC451975A13BC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2