Extracted

• • Target
    4211be3d55ce18b2496217bd331718836897f1878305e59571b2caf9aba99466
  • Size 45KB
  • SHA256 4211be3d55ce18b2496217bd331718836897f1878305e59571b2caf9aba99466
  • MD5 e335f4819d91e4c48e82e89f302fb580
  • SHA1 71191befdac1cdbddcedbe0e194d1ad94e8e66b7
  • SHA512 6a1294f38745767c34710e3c36e279135cdcc3d8bd4efa7cc4c09b3e539e4bc5977402b074b75479c03923922c718a740181e9a506d54fd7fccdf198b3f1385a
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9nDEbHBqj2OPI/pzjbUgX3iOaxwIL2xYhBDZsx:EulCJTHl42IyoK3/p3b7XSOOwIL2x4du
  • TLSH
    T1EA230A0037E8812BF2BE5F78A9F26145867AF6633A03D54A1CC441D75723FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2