Extracted

• • Target
    4cfd30726ca778bfee1c5e1a411d4b37709ec8f5b881c0f6f0bad8f52315c30f
  • Size 45KB
  • SHA256 4cfd30726ca778bfee1c5e1a411d4b37709ec8f5b881c0f6f0bad8f52315c30f
  • MD5 f708176d00f2e656b22130028cc824de
  • SHA1 37c2549747ee256707d8ebddb95579d5c4e2125b
  • SHA512 2e53d26fe2ab29c5de859de565b705193e9924af12450973f7296237105c98ed95ff6cfad13ae96ee53878ca97c727014655b01876ffb6075e9d3a0c6c15be10
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtSCSwTMjPIuHjbmgX3iHOSVyuFTDo5ZJiBDZ0x:5udApTNmU2lg1uDb5XSHOruC5cd0x
  • TLSH
    T1BB231A0037D9822BF2BE4F7899F26146867AF6673603D58D1CC441DB5623FC69A026FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2