Extracted

• • Target
    4d6f21404602a52f2a487a5bf571409d2e0fa9c4296fe2a06b7e889dc9d92104
  • Size 45KB
  • SHA256 4d6f21404602a52f2a487a5bf571409d2e0fa9c4296fe2a06b7e889dc9d92104
  • MD5 9f799eae0107340dc36358361125c648
  • SHA1 d02a86ed2d52afa9e8d312d8cabaec8710772d1c
  • SHA512 1230902538ffde5000207ee7e427e4343e2870b60be88c4163efaf580cbfc9fa852b1fb91656ff1800b3908ed7acc13cf168ab897c7030896cc303b703ccfc70
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1910CnMQRPn98PIQBjbegX3ifWXF44ctuXxXYmJBDZW:cuR0JTPjY2ktnbvBQRbhXSfmFtcixImk
  • TLSH
    T1F9232B0037E9812BF2BE4F78A9F26145867AF5732603D64E1CC451DB5623FC68A436EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2