Extracted

• • Target
    4752c72321f6002eb8abf12e8bedb10f7f116a804a1a8b100f35e187bf9ea1d9
  • Size 45KB
  • SHA256 4752c72321f6002eb8abf12e8bedb10f7f116a804a1a8b100f35e187bf9ea1d9
  • MD5 6e8e04eb1c15aa9e12462418b3d902ae
  • SHA1 25579020d15b0e754d89988f9524f6b7aef6da03
  • SHA512 acc758430387c03ef7efe90ea21ca09282fc649d94cc6a3b2b13f5880c23e473176845f112e11f03672aaacbca82c291918957263aac86d43408199eb96e7b2f
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFc0KFWKoobbb4vhy/nPIA4zjbcgX3i33mo9duIFYISm:MuLAZTnbg2OKdivh4AA43bzXS3Wo9due
  • TLSH
    T139231A003BE8C12BF2BE4FB8A9F26145867AF1633603D54A1CC4529B5713FC69A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2