Extracted

• • Target
    d4aeb2d4798c1181dd46967c16681b3cde15185f9b29bbda77b469e0c6b684fc
  • Size 45KB
  • SHA256 d4aeb2d4798c1181dd46967c16681b3cde15185f9b29bbda77b469e0c6b684fc
  • MD5 0c7a40fbc217bc41dc9de1bcc24e9f07
  • SHA1 14505fcfd4b88d70a2aa7c162b7743319016d48e
  • SHA512 3bef6bbc472ccec4a2480c9d622a5ba195c07450fa2c55424ee81ac6138e8cf5588c1c9a78d9a647d4918238bca2290d46e717c9a10faca701938d5bb8604463
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1WT9Qpm9PIrzjblgX3iAJplLSIPOUQMUBDZcx:RuxkJTgip2BQr3biXSiMgOUpidcx
  • TLSH
    T143232B003BE8823BF2BE4B789DF26145467AF6633603D5492CC452DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2