Extracted

• • Target
    4e198855c1fef032c267d0eff0753572ce19b72f9b8260e0c83b9214914eed3f
  • Size 45KB
  • SHA256 4e198855c1fef032c267d0eff0753572ce19b72f9b8260e0c83b9214914eed3f
  • MD5 3854077db5f634445ccbc80fcb7b3fe7
  • SHA1 185b67c7e63aebc068df0f74b112b42f927da5e6
  • SHA512 18cfc88d54d1ef296b846ef3d82c577b62ba580fcf20230cef1ab021a7d795431469866d5c7d7da6cffd71ffd895a2184f8b1d288cdeadbdd59f24c9ce938019
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAQBzwQ/x7PIP6jbtgX3i3UdlPjZBDZcx:UuKWgSJTwRf2gaFPWb6XScN7dcx
  • TLSH
    T1E3231A003BE8C13BF2BE4FB8ADF26145867AF6632603D9496CC451D75613FC686426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2