Extracted

• • Target
    4c7bcdf1760049aefcdf68a3e5b3ed3833ce1ddba94bc249bfa97ce6c8ef2119
  • Size 45KB
  • SHA256 4c7bcdf1760049aefcdf68a3e5b3ed3833ce1ddba94bc249bfa97ce6c8ef2119
  • MD5 6b6e71ffdac239292fccca9957745122
  • SHA1 d31592b6c5b0836457319b95866d2ef495578b9d
  • SHA512 138d054aa852da4eb3d05986cc1f05345e1020845473c501b7a9e778c65cf0f127d83af5cf06b04c50dd4310aabaff55503afde5a7ff171e4a064570adb2056e
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFD3xY6yZoOPI5zjbXgm3iDll6ViyJFcuLR1FlBDZUx:cu7e5TH2A22uPo353bwmSTGcu1bdUx
  • TLSH
    T15A231A003BE8822BF27E4FB899F26145467BF6633603D54E1CC451DB5613BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2