Extracted

• • Target
    473eee9e2e0bd302821f3c545a5798ba4ebab94ff306c4a044afa109bbca1481
  • Size 45KB
  • SHA256 473eee9e2e0bd302821f3c545a5798ba4ebab94ff306c4a044afa109bbca1481
  • MD5 9dbc4c4aae182ea3dd33c91964d88ac7
  • SHA1 4279f9703c55665c0e6319f20565c0005f57baa0
  • SHA512 eff3538e3ba9174fc6b9a2137a2cb05f0b321dc9e5ec8b2091c651c88591662deaed2e28f78a202aac912e6f978f1e9ddc3122710c10f242e7ad7d9fc1fe2005
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4zqr8yfzuOPIezjbIgXviqwfdQO3BDZ0x:8uUIpT4vAj2nqYJ3e3bfXKNHd0x
  • TLSH
    T1D723290037E9C12BF2BF4F78A9F26145867EF6636603D54A1CC412DB1613BC68A52AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2