Extracted

• • Target
    410bfc32029266ff43d69e57f2f25211f014dc3771e2231f4173d422993ef40a
  • Size 45KB
  • SHA256 410bfc32029266ff43d69e57f2f25211f014dc3771e2231f4173d422993ef40a
  • MD5 1491150162b37706a516b79d35eb7234
  • SHA1 c0f56bf63b7d9dc07ef821668f889a41b2947a24
  • SHA512 548e0753db8b5dee8f770d8073ae2c124c06e9163340a73d2638938d6be9582d798608fa0a08b8622ef9a52c70ae3e51675831c8de5e5747c5ea50c8feacd7ad
  • SSDEEP 768:4uBGJTP0BQ0UWUWHaimo2qVzsD/pneqPIkzjbQgX3iFysJ82FChrLn8BDZ4x:4uBGJTPho2QsjJeTk3bXXS7J8i0rLnaQ
  • TLSH
    T1CE233B003BE8822BF2BE4F78A9F26245867AF5633603D54A1CC451DB5713FC6D642AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2