Extracted

• • Target
    4d184dfe5f8756f16f41d04e9c299c307630ccca3ca03c2105b62721667b0fbe
  • Size 45KB
  • SHA256 4d184dfe5f8756f16f41d04e9c299c307630ccca3ca03c2105b62721667b0fbe
  • MD5 1b1b8f4a89f0c6acd1a5259cd26b84f9
  • SHA1 a1dd9b6ed70e44a603a5290218fa4e3e10f73742
  • SHA512 45f65d55585af84e1d57e525ec81396aba836d3a083871cf5988ae0bf3e7d8a983be3176c7e714669e4a3d50868e55c60b843414bb7c4786e9e747ee9ad825c2
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9ah5BewwbOPIMQzjbPgXKihVLXoCg09RKsFBDZsx:EulCJTHl4219F23MQ3b4XzzjTjLdsx
  • TLSH
    T1FA232B0037E8C12BF2BE4F78ADF26145467AF6673602D68E1CC4419B5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2