Extracted

• • Target
    804a4e1c72761c88f2a071c3c4d4479bb808218edd4183d4249b3bed32756588
  • Size 45KB
  • SHA256 804a4e1c72761c88f2a071c3c4d4479bb808218edd4183d4249b3bed32756588
  • MD5 1fbbc6f77508e8c1238e14b88b6b5608
  • SHA1 002e7c5f95d3384966019cbbe27c1e20c3d1818e
  • SHA512 5fc2f9cdc876e68b0cea3d954dde1cbf6351a26dd8bc329a70b225ec8488351c040c03b6ccad1bd9e2a3186a5b2474abbacd775544084d07e2b69e3b25d618ff
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFP9xY6aZOOPIrzjbKgh3iSHYttILxW4ykfXhBDZUx:cu7e5TH2A26s/O3r3bdhSS4ebvdUx
  • TLSH
    T1D9232B003BE8812BF2BF4F789DF26145867AF2A72603D5491CC452DB5B13FC69A425EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2