Extracted

• • Target
    4f0b00b942c33c6b43c8381f29f360c8bc5382c28e4b5750b755ed04b4982f82
  • Size 45KB
  • SHA256 4f0b00b942c33c6b43c8381f29f360c8bc5382c28e4b5750b755ed04b4982f82
  • MD5 f9b916910993e5cfe263e208869ab496
  • SHA1 19c2d5f5c29ce53ac4f53cfc05e966fffd686798
  • SHA512 0b964ca22a2d31d8a570ce33e415f16c39f7d4405f6ff4c853e39e2a9cdfb382b5da43cf793eb87e66293f68c4f5b4e96d9a823c5a6f1b2eff51e245b28b733d
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q94O5QPCBAPSNjPIRzjbKgX3it3ur79sM8niI4p6ZBc:EufspTf2g2hO5svSKR3bdXStasM8niIE
  • TLSH
    T15123290037E8812AF2BE4F78A8F26145867AF6637603E54D2CC451DB5713FC69642AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2