Extracted

• • Target
    d4cf04d6623a06c9d50f8b3d118146460300aa384cd9527e474ad3c914c8729b
  • Size 45KB
  • SHA256 d4cf04d6623a06c9d50f8b3d118146460300aa384cd9527e474ad3c914c8729b
  • MD5 dd9355a5d975510867b7d3421afbc4d2
  • SHA1 cf93ecea3259f03c0a1306f5903ff29812853409
  • SHA512 dc915cb59cb0a72286c0d97c1d7f686073294b149375783c6b03578261bca72b653879e4bd11d2c4deb15553a2882dd2f7fe05e950c9cde38bd5c93382c87595
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4UITnyfaaPI+zjbrgX3idAWm6X66HhKCemMBDZ0x:8uUIpT4vAj2wEh+3bUXSdVXHwTd0x
  • TLSH
    T1A4231A0037E8C12BF2BF4F7899F26145857AF6673A03D5891CC411DB5623BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2