Extracted

• • Target
    e4771bc4490d442e9e5af42aecd2102ff8976f8f3f9cbdb76f9b771ddef2687b
  • Size 45KB
  • SHA256 e4771bc4490d442e9e5af42aecd2102ff8976f8f3f9cbdb76f9b771ddef2687b
  • MD5 33448b5699cd4660891614b829188f56
  • SHA1 dbc8ef7860eb4983643425f390aa3f53ee19d19a
  • SHA512 2fdc7eea1d83ea9a9273e04af7e070fe5f2454a70457773eb0a3d0268f3ab40cb6b3f3985accfeff3b33a753cc9ff3ffcd20fa13c093cbf009a93bcebae87eda
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1Gw0Q+KXPILzjbDgX3iVgdMiBDZUx:cu6YepTPso2X9L3bcXSSvdUx
  • TLSH
    T16B2319003BE8823AF2BE4BB8A9F26145867AF5733603D5492CC451DB5623FC696426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2