Extracted

• • Target
    4d71292fbad0e08b49862f521b574ac97d7c8b168c59c769916c85f0ed39ed69
  • Size 45KB
  • SHA256 4d71292fbad0e08b49862f521b574ac97d7c8b168c59c769916c85f0ed39ed69
  • MD5 74dd38e742b79fecb9ca0eda04f66c0a
  • SHA1 6613dde12a797e89e49188103afb2db28b24ce8f
  • SHA512 b2650b81abd16b256fe3c864cd503400954f80efee05aa4e4157697617680613c8295a0bcc9423de63871dd3cda7dceca419bc219e8b4df39ca3bcdec7690dc0
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1g5+ZGj9HuPICzjbrgU3iCcGOh0PeImx4TBDZUx:cu6YepTPso2J2+3C3bUUSC9PEe1dUx
  • TLSH
    T1182319003BE9822BF2BF4FB4A9F26145467AF1637603D6491CC442DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2