Extracted

• • Target
    4c510bb689425686587de03106c014f479bf79904bf3429dd7a45da1003ec15e
  • Size 45KB
  • SHA256 4c510bb689425686587de03106c014f479bf79904bf3429dd7a45da1003ec15e
  • MD5 10f00ab809d1f05b615eef6af11f2552
  • SHA1 3606df8a84a6ae6c3f4cac0e6680dac172d97aa5
  • SHA512 30af06ca5e571145f81292f0faba6302488cb1d6ae9d6b3db2c6d27b772f5000cad89cc510a72e567855706fb6ac4bef3fe833d6ec1cd1c902ea171e6b97bd1f
  • SSDEEP 768:5udApTNctooWUS7C+mo2qthRzMwnOPIZzjbogX3iUtHtf53TBQUB+rw9BDZ0x:5udApTNmU2qA+3Z3b/XSUtHtxDBQrETU
  • TLSH
    T176232C003BE8822BF2BE4F78A9F26145867AF5673603D54E1CC451DB5713BC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2