Extracted

• • Target
    4e6a8442752c3613e2571a230de08bc11898d50640812a69ddf0df3b1378b2d9
  • Size 45KB
  • SHA256 4e6a8442752c3613e2571a230de08bc11898d50640812a69ddf0df3b1378b2d9
  • MD5 320e3f7d7036dbbe4e1775ea9f852140
  • SHA1 b3009a3cabf5703103d36eeb078c58b7cee33020
  • SHA512 5e3680b64a1568921ef1f489b1beb42475c191e8ee777c9885668c220f18963c2db3dbfb257fb7f04f975415c30c42ad1dd7aa01688edb7d7878041f10bd3e5c
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9L9YSkqXzNOPISzjbAgX3iLQVTZncUI5XjzVtP2BDI:EufspTf2g2maVq3S3bnXSLondmJYdsx
  • TLSH
    T17B232A003BE8C12BF2BE9F7899F26145467AF2633603D6491CC452DB4713BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2