Extracted

• • Target
    4577764554ee2e3394f567708e2ccd5a5f502a45b8ff0a8c22b360cdbb10671d
  • Size 45KB
  • SHA256 4577764554ee2e3394f567708e2ccd5a5f502a45b8ff0a8c22b360cdbb10671d
  • MD5 23f2e59d303f1a14adf175290760e82a
  • SHA1 84ab35b41e631da856bea87d0ea4a1af29093214
  • SHA512 7886dd22d8bcd551a7a15c02d71ed6ba8b8a3bda9103f282e4ac9dfb417d5b6a22537c38c62e3ff22d26db256cb78715e9f6071564f3d15c6427b7ccbb6bfb65
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1a/qpG3jHuPIgzjbdgXkiA/nIuPtYzAYgRJyBDZcx:RuxkJTgip2nIM3g3bKXhAfIuPtYJgROs
  • TLSH
    T1C5231A0037E8812BF2BE4FB898F26245867AF6637603D54A1CC451DB5723FC6DA426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2