Extracted

• • Target
    394f4883684f1ebdbd62bb8c7fbcf09ea3034e41b512db854c7ed80789c92366
  • Size 45KB
  • SHA256 394f4883684f1ebdbd62bb8c7fbcf09ea3034e41b512db854c7ed80789c92366
  • MD5 4a983bc2ea403d409683361327ef8345
  • SHA1 65f06765de3e6a6714adc9f5b85fb8e53ceb19b5
  • SHA512 a9376815affe6ccd56d4d4bc099422cdcbb77e632ce0730eac41fc22b81853dc76b6215ffa65c61f11dd15c53c98b5727dd8705f8cf64fec5299f09cee303743
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVE2q0CCMPd4CvS8PImmjbLgX3iXw46Wc+MLnBDZEx:MuBGJTPho2dRCEWBmKb0XSXnDQBdEx
  • TLSH
    T18C231A0037E9812BF2BF4F78A8F26145867AF6636603D5491CC451DB5B13FC68A436EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2