Extracted

• • Target
    4bb5d77392ce429e8762918bfc6db89f895c2449956de972688958d8675721b7
  • Size 45KB
  • SHA256 4bb5d77392ce429e8762918bfc6db89f895c2449956de972688958d8675721b7
  • MD5 281ca2b07a5914f412140b79ff95f89b
  • SHA1 78c687fc429396402defe4c7466ddc9be25b1245
  • SHA512 513cb28ce987f26fcbcb1b76bfc10a8f6d6c7caafe88ce807b764aa1d6e6b7fe77d85433f6ce0ac754a812ac4ca591823189272f0feb1635341be37e73805c35
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFA7lt440WMOPI0szjbmgXhi/X2WxmOMfLcskJ6qBDZG:MuLAZTnbg2VgUM30s3b5Xw/GqRYLn0dG
  • TLSH
    T1D4231B003BE8812BF2BE8F7898F26145467AF5773603D54A1CC452DB5623BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2