Extracted

• • Target
    4673c18ebf4fe530dd4e0541088b33baebfbe801ab5f620b7249bf18e82ae0f6
  • Size 45KB
  • SHA256 4673c18ebf4fe530dd4e0541088b33baebfbe801ab5f620b7249bf18e82ae0f6
  • MD5 803fa53692ce3302027cb2fd27183f0e
  • SHA1 e2efaa46d3e089e94c1644df768bbb951870355a
  • SHA512 ef185dda783817a2941f5ece4b3c6addf7838cc8e3aa5beb326dc6e1862f0f1b3eaa62488e4c0a1f347c1c61f9d69f2f131640ef0a2d69f6377df3a63c677dc9
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qN1O5QSCBzHSNjPI7zjbqgX3i437MesQGV/YnyBDZ2:5uSy6pTpoo2kO59ESK73b9XS4raYnMd2
  • TLSH
    T115232B0037E8812BF1BE4F7899F26145867AF6637503E54A2CC412DB5613FC6CA42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2